Systems and Methods for Management of Data Platforms

ABSTRACT

In system for analyzing large data sets, document/file format can be discovered by attempting to parse the file using several parsers to generate a schema, assigning a score to each parsing, and selecting a parser based on the assigned scores. Schema element attributes, such as statistical parameters, can be derived and used in identifying schema elements associated with other files. Attributes of identified schema elements can be used to substitute missing data values with values based on such attributes. Data values corresponding schema elements can be selected and highlighted, and schema elements and/or attributes thereof can be highlighted based on selected data values. From a cluster of files, a lineage relationship between file pairs, indicating whether one file is derived from another, can be determined for several files. In reducing/compacting data, utilization of all available reducers can be optimized according to current utilization of one or more reducers.

FIELD OF THE INVENTION

The present disclosure generally relates to data storage and retrievalsystems and, in particular to systems and methods for facilitatingefficient analysis of vast amounts of data stored and accessed usingsuch data storage systems.

BACKGROUND

Big Data is gaining a lot of traction in the enterprise world. Manycompanies have started their big data initiative, e.g., based on Hadoop.The promise of big data is that one can extract insights that could notbe extracted before, because traditional platforms often do not allowfor analysis of data at high speed, huge volume, and large variety(e.g., unstructured data). Examples of such useful insights includepeople's online behavior patterns, customer sentiment, segmentation,market trending, gap discovery, and so on.

One particular paradigm, that of the Data Lake or Data Hub, is emergingas a common framework of viewing a big data platform in an enterprise. AData Lake is a logical place to store practically unlimited, amounts ofdata of any format and schema, and is relatively inexpensive andmassively scalable due to the use of commodity hardware. A Data Lake canbe implemented using Hadoop, an example open source platform built oncommodity hardware and map reduce as a powerful analytics framework, cansignificantly reduce the cost of storing and analyzing data. The coreidea is generally to keep all the data including the data that has beentraditionally thrown away in the Data Lake and leverage it at somefuture date/time for data science manipulations and analytics.

The Data Lake, however, may quickly face some challenges of its own, asthe amount of data grows rapidly. Due to the experimental and iterativenature of data science and how a typical Data Lake, in general,processes data, many temporary files are created on the cluster. It isnot uncommon to encounter clusters with millions of different files,some of which am transient, some are opaque, and some are simplytemporary files generated by people or programs. Currently, mostclusters are managed through naming conventions and good citizenship ofits users. Very little of the storage and retrieval is managed in asystematic manner. As a result, instead of the intended Data Lakes theclusters often become data dumps.

While enterprises rush to Hadoop (or similar Data Lake paradigms, ingeneral) for its promises as a data platform, it is relatively new andimmature, even to the developer community, more so as an enterprisegrade platform. For example, lack of management on the platform couldturn an expensive Hadoop investment into a data dump thereforediminishing the return on investment (ROI).

An important premise of Big Data and the Data Lake is that data will bethere and available to the users when it is needed. If there is no wayto find the data or if the data is not usable, these impediments candefeat the purpose of having the Data Lake. If the users of the datalake always know exactly which files they need and understand thecontent of the files well, they can access the required data. In thecontext of typical enterprise data management, however, this assumptionis not realistic, i.e., the users generally do not know which files theyneed and what a certain file or a set of files contains. It is notuncommon to see clusters of millions of files and, as such, without asystematic approach the problem of preventing a data lake from becominga data dump is difficult if not impossible to address throughconventional processes and manual intervention. Therefore, improvedsystems and methods are needed that bring the Data Lake platform to thenext level as an enterprise grade data platform that delivers the valuethe industry may seek from it.

SUMMARY

Various embodiments of the present disclosure describe systems andmethods that enable systematic organization of data on a data platformso that the users can reliably and efficiently access the data neededfor their analysis without requiring substantial, if any, knowledge ofthe data organization. This is achieved, at least in part, by performingan automatic inventory of all files, and by capturing the lineage,format, and profile of each file in a metadata repository. A commonproblem with many data files is that a file may not include a header row(e.g., csv without field headings). In some instances, field names mayexist, but they may be uninformative (e.g., col1, col2), ambiguous(e.g., a header “name” in cities table may imply something differentfrom the same header “name” in customer table), or misleading (e.g., the“gender” field is sometimes overloaded for business customers toindicate whether they are a public or private corporation, LLC, etc.).In various implementations, the meaning of values in the fields of afile can be deduced by analyzing other files that have field namesand/or have been tagged by a user with meaningful tags. Provenance,history, and lineage of files in the Data Lake, and changes in filesover time, can be inferred by analyzing file properties such astimestamps and file contents. The inferred lineage information can beintegrated with existing enterprise metadata repositories to providecomplete lineage. The lineage information can be useful in determiningthe validity of changes in files, and to distinguish between temporaryfiles and those to be used for data science analysis.

File purpose discovery, e.g., determining whether a file is transient(also called temporary), and not permanent, relies heavily on lineagediscovery. File purpose discovery seeks to determine lineage: whether a“derived from” relationship exists between a pair of files. Lineageinformation is an important type of metadata, and it can facilitatedetermining the origin of a data to determine whether that data is fitfor a specified purpose. Lineage information can also be used in impactanalysis: if a model depends on a set of data, it can be important tounderstand upstream data sets the quality and/or authenticity of whichcan impact the validity of the model. Lineage information can also beused to ensure compliance requirements with external data contracting.For example, data received from a third party are often associated withstrict legal constraints on how these data can be used. For example,some data vendors require that all data subsequently derived from thevendor data be removed if the customer stops paying for the originallyreceived data sets. Analysis of the lineage of the data used for aspecific purpose can be used to ensure that any data derived from thereceived third party data was not used for that purpose, in violation ofthe legal requirements. System origin and lineage are generallyimportant in electronic discovery.

In a typical data platform, files are generated all of the time. Manyoperations, such as running a custom program, a script (e.g., a Pigscript), or some Extract, Transfer and Load (ETL) program, derive filesfrom other files. The lineage discovery process, in general, is a way ofcomparing among a set of files to derive a lineage diagram. At a highlevel, there are two steps to this discovery process. First, a set offile properties is discovered. The properties may include one or more ofupdate and read timestamps, directory structure and naming conventions.Then the files are processed and the properties of the data inside thefiles are analyzed. File properties such as create, update and readtimestamps can help narrow down the possibilities of two files beingderived from one another. Directory structures and naming conventionscan help identify the function of files. For example, directoriesdesignated as landing areas would only hold files loaded into thecluster and not created inside the cluster. Second, the files arecompared, i.e., the properties and/or the contents of the files arecompared to evaluate likely “computed from” or “derived from”relationships between pairs of files.

In order to be able to analyze the content of the files, file formatneed to be discovered and files need to be parsed. Automatic formatdiscovery and format registry, format validation, and format changedetection can be employed to determine the format of each file in theData Lake and a parser suitable to parse that format. The detectedformat and the associated parser for each file can be recorded in therepository.

Accordingly, in one aspect a computer-implemented method is provided tofacilitate lineage and/or purpose discovery. The method includesidentifying a number of different candidate pairs among several files.Each candidate pair includes a respective first file of the severalfiles and a respective second file of the several files, such that thesecond file was created after the first file was created. The methodalso includes calculating one or more respective first scores for eachof the candidate pairs. Each respective first score is a measure of anextent to which the second file of the pair was derived from the firstfile of the pair. A second file of one of the one or more candidatepairs is selected such that none of the other files of the candidatepairs were derived from the selected second file, based on therespective first scores of the candidate pairs. The method also includesidentifying one or more ancestors of the selected second file based onthe respective first scores of the candidate pairs such that eachancestor was used to derive the selected second file or was used toderive another ancestor of the selected second file. Finally, the methodincludes generating a lineage for the selected second file such that thelineage includes the identified ancestors of the selected second file.

In some implementations, the second file of each of the candidate pairswas created or updated within a specified time period since the firstfile of the candidate pair was read. A second file of a particularcandidate pair can be determined to have been derived from a first fileof the particular candidate pair if one or more of the respective firstscores each meets a respective threshold. Calculating one or morerespective first scores for each of the candidate pairs can includecalculating a schema measure for the candidate pair based on an overlapbetween a respective schema of the first file of the candidate pair anda respective schema of the second file of the candidate pair.Alternatively or in addition, calculating one or more respective firstscores for each of the candidate pairs can include calculating a contentmeasure for the candidate pair based on an overlap between respectivecontent of the first file of the candidate pair and respective contentof the second file of the candidate pair.

In some implementations, calculating the schema measure for a candidatepair includes calculating a respective first column signature for one ormore columns in the first file of the candidate pair, and calculating arespective second column signature for one or more columns in the secondfile of the candidate pair. Calculating the schema measure furtherincludes identifying one or more columns in the first file of thecandidate pair that are similar to one or more columns in the secondfile of the candidate pair, based on a comparison of one or more firstcolumn signatures to one or more second column signatures. A schemameasure can be calculated based on, at least, a number of the identifiedcolumns. A particular column signature for a column can include one ormore of the following: a data type of the column, a distribution ofvalues in the column, frequent values in the column, a frequency ofvalues in the column, a frequency of lengths of values in the column, afrequency of patterns of values in the column, and output of one or morehash functions applied to values in the column.

Alternatively or in addition, calculating the schema measure for thecandidate pair can include determining a number of schema elements inthe first file of the candidate pair that are similar to schema elementsin the second file of the candidate pair, and calculating the schemameasure based on, at least, the number of schema elements that aredetermined to be similar. A particular schema element can be:hierarchical, a key, an element, a name, an attribute, or a column. Insome implementations, calculating the content measure for the candidatepair includes determining a degree of overlap in values of one or moreschema elements in the first file of the candidate pair with values ofone or more similar schema elements of the second file of the candidatepair. The content measure can be calculated based on, at least, thedegree of overlap.

The method can further include identifying a file in the lineage havingone or more ancestors and one or more descendants. The identified filecan be designated as temporary, e.g., if a number of descendants of theidentified file does not meet a threshold, if the identified file hasbeen used in a join operation with another file, if a plurality of thedescendants of the identified file are in different respectivedirectories, if a name of the identified file indicates that theidentified file is temporary, or if the identified file is read orupdated frequently. A file can be designated as temporary if any one ormore of these conditions are met. The identified temporary file can bedisposed based on a user specified policy. Disposing can include one ormore of: removing the temporary file, archiving the temporary file, andcompressing the temporary file after a specified period of time.

In some implementations, identifying a particular candidate pair amongthe various files includes identifying a pair of files of the severalfiles that have respective names or file paths that partially overlap.One file of the pair of files can be designated as the first file of theparticular candidate pair and the other file of the pair of files can bedesignated as the second file of the particular candidate pair.Additionally or in the alternative, identifying a particular candidatepair among the several files can include identifying a pair of files ofthe several files that have respective names that include timestamps,have respective names that include a substring and a respective number,have a substantially same number of rows, or if one of the files of thefile pair is read frequently. If one or more of the conditions above canbe met, one file of the pair of files can be designated as the firstfile of the particular candidate pair and the other file of the pair offiles can be designated as the second file of the particular candidatepair.

In some implementations, calculating one or more respective first scoresfor a particular candidate pair includes determining that the first fileof the particular candidate pair has been designated by a user as adescendent or that the second file of the particular candidate pair hasbeen designated by the user as an ancestor. One or more of therespective first scores of the particular candidate pair can be set orreset to indicate that the second file of the particular candidate pairwas not derived from the first file of the particular candidate pair.

In another aspect, a computer-implemented method for automaticallygenerating data sets includes monitoring a number of files over time forchanges to content of the files. Each file can have a respective schemaand wherein the changes are to values of respective schema elements. Themethod also includes deriving one or more transformation rules based onthe monitored changes. Each transformation rule can specify, for arespective schema element, a treatment of a respective value of theschema element. In addition, the method includes selecting a respectiveschema element for each of several model variables, and identifying, foreach selected schema element, a respective file containing values of theselected schema element. For one or more values of the respective files,the value is transformed using the transformation rule for therespective schema element that matches the schema element of the value,and a first file is generated from the identified files wherein thefirst file contains values for one or more of the selected schemaelements.

In some implementations, transforming the value using a transformationrule for a respective schema element that matches the schema element ofthe value includes one or more of: replacing the value with a valuehaving a coarser grain, replacing the value with a default value, orreplacing the value with an anonymous equivalent value. Alternatively orin addition, transforming the value using a transformation rule for arespective schema element that matches the schema element of the valueincludes determining that the value is empty and, based thereon,deleting a row from the file that contains the value, in someimplementations, transforming the value using a transformation rule fora respective schema element that matches the schema element of the valueincludes determining that the value is an outlier and, based thereon,deleting a row from a file that contains the value or replacing thevalue with a value that is not an outlier. In some implementations,transforming the value using a transformation rule for a respectiveschema element that matches the schema element of the value includes,additionally or in the alternative, determining that the value is emptyand, based thereon, replacing the value with another value that isinferred from a value in the one or the respective files for a same ordifferent schema element. The value can represent gender, ethnicity, andor geographic location.

Generating a first file from the identified files can include changing arespective name of one of the first schema elements to a different name.The different name can be a synonym of the respective name or acorresponding name. A particular schema element can be part of ahierarchy of schema elements, a key, an element, a name, an attribute,or a column. Generating a first file from the identified files caninclude generating a new variable based on one or more variables, andselecting a respective schema element for the new variable.

In some implementations, identifying, for each selected schema element,the respective file containing values of the selected schema elementincludes identifying a file from several files having values for thelargest number of selected schema elements. A number of the identifiedfiles cane joined through one or more common keys. The common keys canbe identified using tags from a metadata registry. In someimplementations, one or more respective dimension grains of several ofthe identified files match. Generating the first file from theidentified files can include aggregating respective grains of one ormore dimensions in the identified files to a finer grain. Alternativelyor in addition, generating the first file from the identified files caninclude applying a filter to content in one or more of the identifiedfiles so that only rows that match the filter are retained in the firstfile.

In another aspect, a computer implemented method is provided tofacilitate discover of format, such as document or file format. Themethod includes identifying a number of parsers such that each of theparsers is configured to parse a respective file format and generate arespective schema. A particular schema can be JavaScript ObjectNotation, external Markup Language, comma separated values, a tabularschema, or name value pairs. The method additionally includesidentifying, for each of several parsers, one or more respectivedelimiters that have a high occurrence in files parsed by the parser,such that the high occurrence is an occurrence that exceeds a threshold.The method further includes analyzing a first file having an unknownformat to determine a distribution of the respective delimiters, anddetermining a respective score for each of the parsers. The score canrepresent a likelihood that the parser will successfully parse the firstfile given the distribution and identified delimiters of the parser. Themethod also includes ordering the parsers according to the respectivescores, and applying each parser to the first file according to theorder until the first file is successfully parsed.

A particular parser is determined to have successfully parsed aparticular file if one or more of the following occur: the particularparser generates a correct schema for the particular file and theparticular parser generates schema element values that conform to acorrect schema for the particular file. Additionally or in thealternative, a particular parser is determined to have successfullyparsed a particular file if a number of parsing error correctionsgenerated by the particular parser does not exceed a second threshold.

In some implementations, the method further includes creating anassociation of the format of the first file with the parser thatsuccessfully parsed the first file. Additionally, the method can includedetermining that a format of a second file matches the format of theassociation, and using the parser of the association to parse the secondfile. A particular delimiter can be a non-alphanumeric character.Determining a respective score for each of the parsers can includedetermining a respective success rate for the parser. The success ratecan be based on a number of files in a collection of files that theparser has successfully parsed. The score can be based on the successrate.

Determining a respective score for each of the parsers can also includeobtaining a user-specified regular expression for the parser, anddetermining the score further based on whether a string matching theregular expression occurs in the first file. In some implementations,determining a respective score for each of the parsers includesidentifying a string having a number of characters such that the stringoccurs in a same relative position in files parsed by the parser, andwhere a number of the occurrences of the string exceeds a secondthreshold. Determining the score can be further based on the number ofoccurrences of the string in the relative position in the first file.

In some implementations, determining a respective score for each of theparsers includes identifying a number of the files parsed by the parser,each file having a respective positional format, and such that a numberof the identified files exceeds a second threshold. Determining thescore can be based on a number of positional format features of thefirst file. A particular positional format feature can be, for severalrows in a file, one or more of: an occurrence of a particular data typeat a particular column, an occurrence of a space separator at aparticular column, or an occurrence of a constant value at a particularcolumn.

In another aspect, a computer-implemented method for mapping reducers soas to improve utilization thereof includes performing a map operation ineach one of several mappers on respective input data to generate anumber of respective tuples. Each tuple includes a respective key andone or more respective data values. The method includes selecting a oneor more of the keys from the several keys. For each key K_(i) of theselected one or more keys, if

${{KC}_{i} \geq \frac{T}{R}},$

all tuples having K_(i) as a key are assigned to one of several reducershaving no assigned tuples. KC_(i) is a count of occurrences of K_(i) inthe tuples, T is a count of the tuples, and R is a count of thereducers. Otherwise, if

${{KC}_{i} < \frac{T}{R}},$

all tuples having K_(i) as a key are assigned to reducer R_(j) of theseveral reducers, such that

${{{CR}_{j} + {KC}_{i}} < {{\frac{T}{R}\mspace{14mu} {and}\mspace{14mu} \frac{T}{R}} - \left( {{CR}_{j} + {KC}_{i}} \right)} < M},$

where CR_(j) is a count of tuples assigned to R_(j) and M is a firstthreshold. If the above condition is not satisfied, all tuples havingK_(i) as a key are assigned to a reducer R_(k) having a fewest number ofassigned tuples. The method also includes performing a reduce operationin each reducer on the tuples assigned to that reducer, to generateoutput data.

Obtaining or generating several tuples can include ordering the keysaccording to KC_(l) from highest KC_(l) to lowest. Selecting one or morekeys can include selecting keys such that, for each selected key K_(i),KC_(i)≥N, wherein N is a second threshold. In some implementations,

${N = {\left( \frac{T}{R} \right) \times c}},$

where c is a constant. The threshold M can be specified as

${M = {\left( \frac{T}{R} \right) \times c}},$

where c is a constant.

In some implementations, the includes, for each unselected key K_(i),assigning tuples having K_(i) as a key to reducer R_(p), where p is afunction of K_(i). The function p can be a hash function. The mapperscan operate simultaneously so as to perform the map operation inparallel. The reducers can also operate simultaneously so as to performthe reduce operation in parallel. In some implementations, the methodincludes setting

$R = \left\lceil \frac{T}{{KC}_{i}} \right\rceil$

where x is the reducer having the most tuples assigned thereto.

In another aspect, a computer-implemented method for meta-data orglossary registry includes determining, for each of several files andone or more respective schema elements in the file, a respectivesignature for the schema element. The signature is a characterization ofa number of values of the schema element in the file. The methodincludes, for each of a number of glossary terms, associating theglossary term with the signatures of one or more of the schema elementsthat each has a respective schema element label that matches theglossary term. The method further includes identifying a first schemaelement of one of the several files that does not have a respectiveschema element label. The method finally includes selecting a glossaryterm associated with a signature that matches a signature of a firstschema element, as a suggested schema element label for the first schemaelement.

Associating the glossary term with the signatures of one or more of theschema elements that each has a respective schema element label thatmatches the glossary term can include calculating an edit distancebetween the label and the glossary term. Whether the label matches theglossary term can be determined based on the edit distance not exceedinga threshold. Additionally or in the alternative, associating theglossary term with the signatures of one or more of the schema elementsthat each has a respective schema element label that matches theglossary term can include determining that the label matches theglossary term if the label is a synonym of the glossary term. The methodcan include receiving user input associating the synonym with theglossary term.

In some implementations, selecting a glossary term associated with asignature that matches a signature of a first schema element as asuggested schema element label for the first schema element includesdetermining that the signature matches the signature of the first schemaelement based on one or more of: respective types of the first schemaelement data values, frequency of the types, range of the data values,distribution of the data values, format of the data values, length ofthe data values, overlap in the data values, and overlap in most commondata values. Alternatively or in addition, selecting a glossary termassociated with a signature that matches a signature of a first schemaelement as a suggested schema element label for the first schema elementcan include identifying a number of glossary terms that are associatedwith respective signatures that match the signature of the first schemaelement. One of the several glossary terms can be selected based on oneor more specified criteria. A specified criterion can be a count oftimes that the glossary term is used as a schema element label in theseveral files.

In some implementations, the method includes providing the selectedglossary term as a suggested label for the first schema element, andreceiving user input accepting or rejecting the suggested label. Each ofthe several glossary terms can occur as a schema element label in arespective collection of different files associated with a respectivegroup of different users, such that a count of the group of usersexceeds a specified threshold.

In some implementations, a particular schema element can be any of aneXtensible Markup Language (XML) fragment, a JavaScript Object Notation(JSON) structure, a Graph DB graph, a portion of a relational, columnar,in-memory or non-relational database, an object store schema element, ora log file. A particular schema element can be hierarchical, or can be akey, name, an attribute, or a column.

In some implementations, the particular schema element is a columnfield. The signature of the particular schema element can include one ormore of the following: a data type of a particular schema element, aminimum value and a maximum value of the values of the particular schemaelement, a distribution of values of the particular schema element,frequent values of the particular schema element, a frequency of valuesof the particular schema element, a frequency of lengths of values ofthe particular schema element, a frequency of patterns of values of theparticular schema element, output of one or more hash functions appliedto values of the particular schema element, and a regular expression forthe values of the particular schema element. The particular schemaelement can be an XML fragment or a JSON structure, and the signature ofthe particular schema element can include one or more of the following:elements, attributes, Uniform Reference Locators, XPATH, dependenciesbetween element values and presence of other elements, average elementdepth, minimum element depth, maximum element depth, element frequency,bad elements, constant elements, implied nulls, profile of elementvalues, and references to other files.

The particular schema element can be a GraphDB graph, and the signatureof the particular schema element can include one or more of thefollowing: average graph depth, disconnected nodes in the graph, mostconnected nodes in the graph, a count of islands in the graph, sizes ofislands in the graph, sizes of the biggest and smallest islands in thegraph, an average size of an island in the graph, and counts of nodeshaving different respective numbers of connections.

The particular schema element can be a portion of a name-value or bigtable database, and the signature of the particular schema element canbe based on one or more of the following attributes the schema elementdata values: cardinality, nulls, functional dependencies between columnvalues and between presence of various columns, least frequent columns,empty columns, constant columns, column groups, minimum, average andmaximum number of columns having values, number of columns, and keycolumns for each column group. The particular schema element can be aname-value or big table database column that includes comma separatedvalues, a JSON object, or an XML document. Finally, the particularschema element can be a log file, and the signature of the particularschema element can include one or more of the following: tags, mostfrequent messages, minimum, average and maximum time between messages,and common fields.

In another aspect, a computer-implement method for contextual meta-datanavigation includes providing a graphical user interface having aninteractive metadata display and an interactive data display. The methodincludes selecting a file having a respective schema that includes anumber of schema elements such that the file contains several values forthe schema elements. Moreover, the method includes presenting on thedata display a number of the values in the file, and presenting on themetadata display, for one or more of the schema elements, respectivemetadata. The displayed metadata can include a number of attributes thatcharacterize values of the schema element. The method further includesreceiving user selection of one or more of the attributes of a firstschema element presented on the metadata display and, based thereon,highlighting the values in the file presented on the data display forthe first schema element and that have the selected attributes of thefirst schema element. Alternatively or in addition, user selection ofone or more of the values of a second schema element presented on thedata display can be received and, based thereon, attributes of thesecond schema element, displayed on the metadata display, and thatcharacterize the selected values, can be highlighted.

In some implementations, the method further includes presenting on themetadata display a number of schema names, each of which corresponds toa respective schema having one or more respective schema elements. Themethod also includes receiving user selection of one of the schema namesin the metadata display and, based thereon, presenting on the datadisplay information about one or more files that have the selectedschema. The information can include one or more of: respective names andrespective file directory locations of the files, and respectivelineages of the files. The method can also include presenting on themetadata display one or more schema elements of the schema thatcorresponds to the selected schema name.

The metadata display and the interactive data display can be presentedor provided on separate display devices. One of the display devices canbe a display on a smart phone, a tablet computer, a laptop computer,smart glasses, or a smart watch. Highlighting the values of the filepresented on the data display that have the selected attributes of thefirst schema element can include hiding the values of the file that donot have the selected attributes.

A particular schema element can be hierarchical, or can be a key, aname, an attribute, or a column. An attribute of a particular schemaelement can include one or more of: a label, a data type of a particularschema element, a minimum, value and a maximum value of the values ofthe particular schema element, a distribution of values of theparticular schema element, frequent values of the particular schemaelement, a frequency of values of the particular schema element, afrequency of lengths of values of the particular schema element, afrequency of patterns of values of the particular schema element, outputof one or more hash functions applied to values of the particular schemaelement, or a regular expression for the values of the particular schemaelement.

In another aspect, a computer-implemented method for meta-data orglossary registry includes determining, for each of several files andfor one or more respective schema elements in that file, a respectivesignature for the schema element. The signature can be acharacterization of several values of the schema element in the file.The method also includes, for each of several glossary terms,associating the glossary term with the signatures of one or more of theschema elements that each has a respective schema element label thatmatches the glossary term. A particular schema element can be aneXtensible Markup Language (XML) fragment, a JavaScript Object Notation(JSON) structure, a Graph DB graph, a portion of a relational, columnar,in-memory or non-relational database, an object stow schema element, ora log file. The method further includes identifying a first schemaelement of one of the several files that does not have a respectiveschema element label, and selecting a glossary term associated with asignature that matches a signature of a first schema element, as asuggested schema element label for the first schema element.

Associating the glossary term with the signatures of one or more of theschema elements that each has a respective schema element label thatmatches the glossary term can include calculating an edit distancebetween the label and the glossary term. Determining that the labelmatches the glossary term can be based on the edit distance notexceeding a threshold. Additionally or in the alternative, associatingthe glossary term with the signatures of one or more of the schemaelements that each has a respective schema element label that matchesthe glossary term can include determining that the label matches theglossary term if the label is a synonym of the glossary term. The methodcan include receiving user input associating the synonym with theglossary term.

In some implementations, selecting a glossary term associated with asignature that matches a signature of a first schema element, as asuggested schema element label for the first schema element includesdetermining that the signature matches the signature of the first schemaelement based on one or more of: respective types of the first schemaelement data values, frequency of the types, range of the data values,distribution of the data values, format of the data values, length ofthe data values, overlap in the data values, and overlap in most commondata values, alternatively or in addition, selecting a glossary termassociated with a signature that matches a signature of a first schemaelement, as a suggested schema element label for the first schemaelement can include identifying a number of glossary terms that areassociated with respective signatures that match the signature of thefirst schema element. One of the several glossary terms can be selectedbased on one or more specified criteria. The particular criterion can bea count of times that the glossary term is used as a schema elementlabel in the plurality of files.

In some implementations, the method further includes providing theselected glossary term as a suggested label for the first schemaelement, and receiving user input accepting or rejecting the suggestedlabel. Each of the several glossary terms can occur as a schema elementlabel in a respective collection of different files associated with arespective group of different users, such that a count of the group ofusers exceeds a threshold. A particular schema element can behierarchical, and/or can be a key, a name, an attribute, or a column.

In some implementations, a particular schema element is a column field,and the signature of the particular schema element includes one or moreof the following: a data type of a particular schema element, a minimumvalue and a maximum value of the values of the particular schemaelement, a distribution of values of the particular schema element,frequent values of the particular schema element, a frequency of valuesof the particular schema element, a frequency of lengths of values ofthe particular schema element, a frequency of patterns of values of theparticular schema element, output of one or more hash functions appliedto values of the particular schema element, and a regular expression forthe values of the particular schema element.

A particular schema element can be an XML fragment or a JSON structure,and the signature of the particular schema element can include one ormore of the following: elements, attributes, Uniform Reference Locators,XPATH, dependencies between element values and presence of otherelements, average element depth, minimum element depth, maximum elementdepth, element frequency, bad elements, constant elements, impliednulls, profile of element values, and references to other files. Aparticular schema element can also be a GraphDB graph, and the signatureof the particular schema element can include one or more of thefollowing: average graph depth, disconnected nodes in the graph, mostconnected nodes in the graph, a count of islands in the graph, sizes ofislands in the graph, sizes of the biggest and smallest islands in thegraph, an average size of an island in the graph, and counts of nodeshaving different respective numbers of connections.

In some implementations, a particular schema element is a portion of aname-value or big table database, and the signature of the particularschema element is based on one or more of the following attributes theschema element data values: cardinality, nulls, functional dependenciesbetween column values and between presence of various columns, leastfrequent columns, empty columns, constant columns, column groups,minimum, average and maximum number of columns having values, number ofcolumns, and key columns for each column group. A particular schemaelement can be a name-value or big table database column that includescomma separated values, a JSON object, or an XML document. A particularschema element can be a log file, and the signature of the particularschema element can include one or more of the following: tags, mostfrequent messages, minimum, average and maximum time between messages,and common fields.

Various implementations of each of these aspects include correspondingsystems, apparatus, and/or computer programs.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1A and 1B schematically depict various functional components ofexample systems of organization of data on a data platform.

FIG. 2A depicts an example process for discovering lineage.

FIG. 2B depicts example computation of various scores used indiscovering lineage.

FIG. 3 illustrates an example computation of schema-based score.

FIG. 4 schematically depicts an example designation of an intermediatefile in a lineage chain.

FIGS. 5A-5F schematically illustrate an exemplary discovery of lineage,according to an implementation.

FIGS. 6A-6C depict examples of processes for format and/or schemadiscovery.

FIG. 7A depicts an example process for automatic data set generation.

FIGS. 7B and 7C depict an example process for generating and applyingdata set transforms, according to an implementation.

FIG. 7D schematically illustrates an data set generation example,according to an implementation.

FIG. 8 depicts an example of a process of mapping reducers, according toan implementation.

FIG. 9 depicts an example of a process for contextual metadatanavigation, according an implementation.

FIG. 10 depicts an example of a process for generating and using aglossary registry, according to an implementation.

FIGS. 11A and 11B depict examples of profiles of tabular data andnon-tabular data, respectively, according to one implementation.

Like reference numbers and designations in the various drawings indicatelike elements.

DETAILED DESCRIPTION Lineage and Purpose Discovery

With reference to FIG. 1A, an example data organization, analysis, andmanagement system 100 includes a data lake 102. Various internal and/orclosely associated data sources 104 and various remote and cloud baseddata sources 106 can supply data, e.g., files, streams, etc., to thesystem 100. An inventory module 108 can perform various inventory andmanagement tasks. Specifically, a monitor 110 can monitor the cluster todetect new, deleted and changed files. A metadata management module 112can process those new or changed files to analyze various fileattributes such as date/time of creation and update, file size, filenames, etc., and analyze data in those files to enable, for example,format detection, parsing, and profiling and to facilitate, e.g.,lineage and purpose discovery. A policy module 114 can enforce variouspolicies regarding access, privacy, data quality, etc. Variousregistries, one or more of which can include private and/or publicregistries may accumulate information that can be shared and used acrossusers and across companies. This information may also be used in dataanalysis and/or data transformations. For example, metadata registry 116can be used to expedite and standardize annotation of files and fieldsthrough the use of tags as well as automated field classification. Theregistry of parsers 118 can be used in format discovery and in efficientparsing of files. The tag definitions and field classifications that arederived by the system 100 as well as parsers for new, previously unknownfile formats, can be stored in these registries, and can also beintegrated with a data catalog 120 that is integral to the data lake102.

With reference to FIG. 18, another example system 150 for organizingdata includes various functions/components 152 provided by an underlyingdata platform. In some implementations, Hadoop is used as a dataplatform and, as such, the functions/components 152 include HIVE 152 a,HBase 152 b, Hadoop Distributed File System (HDFS) 152 c, and HCatalog152 d. Other data platforms can be used including file systems,relational and non-relational database management systems, cloud storagesystems like Amazon S3, and any other file storage and managementsystems. The functions/components 152 can also include external lineagerepositories 152 e, which can be supplemented and/or modified usinglineage determined via lineage discovery. The data organization system150 also includes a Discovery Bot 154 process that can scan and analyzefiles in a specified directory/folder, including those in anysubdirectories/subfolders, and a command line interface 162.

Various modules 156, such as “File lineage” determination modules,Profile and metrics module, etc., can generate a desired view of theunderlying data files. For example, the file lineage module can displaylineage of files in a specified directory. The system 150 also includesa hosted registry 158 which includes a registry for metadata 158 a,which can be used in schema discovery and format registry 158 b, whichcan be used for format discovery. The glossary registry 158 a and/or theparser registry 158 b can include a registry that is private to a singleuser or a group of users and/or a public registry generally accessibleby all users. The entry of items into the registry 158 and editing ofthose items can be controlled using a registry console 160 directly orthrough the Data Inventory GUI 162. Policies regarding removing andarchiving data and protecting data privacy can be specified andcompliance with such policies can be monitored using the controls module164.

FIG. 2A depicts an example process 200 for discovering lineage. Theoperations described in FIG. 2A can be implemented by one or more dataprocessing apparatus connected by one or more computer networks. Thedata processing apparatus can reside in the same or in differentgeographic locations. From a directory or folder to be scanned a file ofwhich the lineage is to be determined is selected in step 202 (e.g., bythe inventory module 108 of FIG. 1A) of the lineage-determinationprocess 200). A timestamp associated with the file, e.g., the time ofcreation, is recorded as well. For the sake of convenience, in thefollowing discussion of FIG. 2A, the file selected in step 202 isdenoted File_A1. In general, any file created after the time of creationof File_A1 can have been based on or derived from File_A1, and filescreated before the time of creation of File_A1 are unlikely to have beenderived from File_A1. As such, in one implementation, the files in thecluster to be scanned are sorted according to a timestamp (e.g., thetime of creation), and the file having the earliest timestamp isselected as the File_A1 in step 202.

In step 204, a candidate derived file (denoted File_B1), i.e., a filehaving a timestamp later than the timestamp associated with File_A, isselected from the directory. In step 206, one or more tests (describedbelow with reference to FIG. 28) are performed on the pair of filesFile_A1 and File_B1 to compute a lineage score for the pair. Thecomputed lineage score can indicate a likelihood that File_B1 wasderived from or is based on File_A1, a higher lineage score typicallyindicating a greater likelihood. The steps 204 and 206 can be iteratedseveral times, selecting a different candidate derived file, denotedFile_Bk, in the k-th iteration and computing a lineage score for thecandidate pair {File_A1, File_Bk} in the k-th iteration.

Thereafter, the step 202 can be repeated to select a file that isdifferent than the previously selected file File_A1. In general, thefile selected in the j-th iteration of the step 202 can be denotedFile_Aj. As the files from one specified directory are typicallyselected for evaluation, it should be understood that the File_Aj mayhave been previously selected as a candidate derived file File_Bk in oneof the prior iterations of the step 204. In the j-th iteration of thestep 202, however, the file File_Aj is selected not as a candidatederived file and, instead, as a file of which the lineage is to bedetermined. The steps 204, 206 are then iterated with respect to thefile File_Aj, i.e., in the k-th iteration a candidate file File_Bk thatis potentially derived from the file File_Aj is selected in the step204, a lineage score, denoted S_(jk), indicating the likelihood that thefile File_Bk was derived from the file File_Aj, is computed.

After all or a specified set of files in a certain cluster or filesystem or directory are selected and evaluated as described above, acomparison, e.g., ordering, of the pairwise lineage scores is performedin step 208. The comparison of scores can indicate direct, and indirectlineage of various files in the directory. These comparisons can bebased on one or more specified thresholds. To illustrate, an exemplarydirectory can include the files X1, Y1, Z1, X2, Y2, z2, and X3. Acomparison of lineage scores for each of 10 unique pairs can indicatethat the files Y1 and Z1 derived from the file X1, and that the files Y2and Z2 derived from the file X2. The scores can also indicate that bothfiles Y1 and Z1 were derived directly from the file X1, the file Y2 wasderived directly from the file X2, and that the file Z2 was deriveddirectly from the file Y2 and, as such, indirectly from the file X2. X3may be derived from a combination of X1 and X2. The correspondinglineage chains can be represented as (X1:Y1; X1:Z1; X2:Y2:Z2; X1,X2:X3). It should be understood, that this example is illustrative onlyand that a typical cluster, file system or directory can include tens,hundreds, or even millions of files. Several lineage chains, each rootedin a file not likely derived from any other file can exist. Some lineagechains can include as few as two files, while other lineage chains caninclude several (e.g., 5, 8, 10, 160, 300, etc.) files.

The determination of direct and indirect lineage can additionallyconsider or weigh heavily file-content-based scores (computation ofwhich is described below). In general, if there is an 80% overlapbetween the contents of the files A and B, a 75% overlap between thecontents of files A and C, and only 50% overlap between the contents ofthe files B and C, in one implementation it is determined that bothfiles B and C are children of (i.e., derived from) the file A, and thatfiles B and C are not derived from each other. Similarly, according toone implementation, if file B is a child of file A, and file C can be adirect child for either file A or file C, if the file C has fieldsand/or rows from the file A that are not in the file B, the file C isdetermined to be derived directly from the file A and not from the fileB. Conversely, if the file C includes content from the file B, that isnot in file A, file C is determined to be derived directly from the fileB and not from the file A, even though, the file B was determined to bea child of file A.

In optional step 210, lineage can be determined by exclusion. Ingeneral, very similar files that are not related (e.g., files created byperiodic data collection) are beneficially not identified as derivedfrom each other. For example, a deposit of stock quotes that is doneevery minute with 300 to 400 attributes, except for the timestamp, stockprice, and volume, the data collected at each minute can be verysimilar. In this example, attributes or fields can be stock symbol,price, volume, company name, industry, 52 week max and min, etc. In someimplementations, such similar but unrelated files are identified as notrelated by determining that some common attributes thereof containdifferent values. The common attributes that can be used for thispurpose can be identified by name and/or attribute signature (e.g.,field signature may include field type, length, data format (e.g.,NNN-NN-NNNN for a social security number format where N is a number. Ais a non-numeric character and non-alphanumeric characters arerepresented as themselves), min, max and average values and valuedistribution for numerical fields, a number of most common values andany other attributes that can determine that two fields contain the samedata. Mismatch in these identified fields—especially fields containingtemporal and geographical data can be used to rule out lineage betweenthe two files.

In some implementations, the time conversion to a different time zone isanalyzed. For example, if two files F1 and F2 are identical except for acommon timestamp field TS such that if both files are sorted by TS, forevery row in F1 and corresponding row in F2, the difference F1.TS-F2.TSis substantially the same. That difference can be the number of hourscorresponding to two different time zones, if F1 and F2 are createdand/or updated in different time zones. In this case, it can be assumedthat F2 was derived from F1.

FIG. 2B depicts example computation of various scores used indiscovering lineage. The operations described in FIG. 2B can beimplemented by one or more data processing apparatus connected by one ormore computer networks. The data processing apparatus can reside in thesame or in different geographic locations. A name based score iscomputed in step 252 (e.g., by the inventory module 108 of FIG. 1A). Ingeneral, the names of File_Aj and File_Bk are compared. If the two namesinclude a common base name (e.g., “inventories,” “orders,” “sales,”etc.), it is likely that File_Aj is related to File_Bk, in the step 252,the non-common portions of the filenames such as suffixes are alsocompared. For example, File_Aj can have a suffix v1 and File.Bk can havea suffix v4, suggesting that File_Bk is a version of File_Aj.Alternatively, File_Aj can have a suffix “XYZ D1220” and File_Bk canhave a suffix “(XYZ D1220 (ABC D1222),” suggesting that someone with theinitials XYZ modified File_Aj on December 20, and someone with initialsABC modified File_Aj on December 22 to create File_Bk. Increasingsuffixes often indicate that a file having the same base name as anotherfile but having a longer suffix than the other file was derived from theother file. In some instances, the filenames can indicate lineage orrelationships to two or more files. For example, the names“SFDC_May_Orders.csv” and “ELOQUA_OPEN_EMAIL_COUNTS.csv” can implyprovenance, and the name “Order_To_Email_Counts May.csv” can indicatethat this file was derived from the first two. As such, based on acomparison of the base names and suffixes, a name based score isassigned to the candidate pair (File_Aj and File_Bk) in the step 252.

A path-based score is computed in step 254. In particular, the files ina specified directory can be stored in several sub-directories, and thefiles in different sub-directories can be related to each other or thefiles in a certain sub-directory can be derived from the files inanother sub-directory. Therefore, if a portion or the entirety of thepathname of the file File_Aj matches a portion or the entirety of thepathname of File_Bk, the two files can be related to each other. Forexample, a directory SAP can be designated as a landing directory forfiles coming from SAP system, and directory Project_Poodle can bedesignated as a working directory for a specific project. It is thenassumed that files in SAP directory are derived from SAP system and notfrom any files on this cluster, while files in Project_Poodle directorycan be derived from files in SAP directory or from each other.

One or more timestamp based scores are computed in step 256.Specifically, if the files File_Aj and File_Bk have substantially thesame base name, and if the timestamps of the two files follow a regularpattern of timestamps in files having that common base name, it islikely that the file File_Bk is not derived from the file File_Aj.Instead, the two files can represent two generally independent instancesof a periodic collection of data of a certain type, such as weeklyinventory data, daily sales data, etc. Therefore a low timestamp basedscore can be designated to the candidate pair (File_Aj. File_Bk). If thetimestamps of various files having a base name substantially common tothat of the files File_Aj and File_Bk form an irregular pattern,however, it is likely that the different files are manually createdversions of the same file. In that case, it is likely that the fileFile_Bk was derived from the file File_Aj and, hence, a high timestampscore can be designated to the candidate pair (File_Aj, File_Bk). Thetimestamps used in this analysis can include one or more of a time ofcreation, time of last update, etc.

Additionally or in the alternative, a timestamp based score can becomputed in the step 256 by comparing the “last-read,” “created,” and“last updated” timestamps of the files. In general, if the file File_Bkis derived from the file File_Aj, the file File_Aj must have been readwithin some period (e.g., a few minutes, a few hours, etc.) from thetime at which the file File_Bk is created and/or updated. In someimplementations, the scan can be performed periodically (e.g., daily),thus, if LastScan is the timestamp the last time we started scanning thesystem, Ra is the “last read” timestamp of the file File_Aj and Cb andUb are the “created” and “updated” timestamps, respectively, of the fileFile_Bk, the file File_Bk can be considered to be derived from the fileFile_Aj if LastScan<Cb<Ra+Tmax_job. The threshold Tmax_job, i.e., themaximum duration of a job/process that can create the file File_Bk fromthe file File_Aj, can be preselected as, e.g., a few minutes, hours,etc. As Ra represents the last read timestamp and because the fileFile_Aj can be read after the file File_Bk is created, it is possiblethat the file File_Bk is derived from the file File_Aj even if Ra isgreater than Cb. It is also possible, though not highly likely, that thefile File_Bk was created without using any of the data of the fileFile_Aj, but was later updated using such data. Therefore, the fileFile_Bk can also be considered to be derived from the file File_Aj ifLastScan<Ub<Ra+Tmax_job. If a cluster is scanned periodically (e.g.,daily), the Cb may be older than the last scan, but Ub is not.

The contents/data of the file File_Aj can be compared with thecontents/data of the file File_Bk in step 258, to compute a data-basedlineage score. A substantial overlap between at least a portion of thedata can indicate that the file File_Bk, having the later timestamp, canbe derived from the file File_Aj having the earlier timestamp. Inparticular, if the files File_Aj and File_Bk contain substantiallyidentical data but have different names, File_Bk can be a copy ofFile_Aj. Additionally or in the alternative, a significant overlap in atleast a part of the contents of these two files can be classified intoone or more of the patterns described below.

If the contents of the two files File_Aj and File_Bk are arranged inrows and fields, an observation that the two files have the same numberof rows can suggest that the file File_Bk was derived from the fileFile_Aj. If File_Bk has the same number of rows but fewer fields, and ifthe fields common to both files have substantially identical values.File_Bk can be determined to be a subset (specifically, a subset offields) of File_Aj. Similarly, if File_Bk has fewer rows but the samenumber of fields as File_Aj, the file File_Bk can be determined to be asubset (specifically, a subset of rows) of the file File_Aj. Often, suchsubsets result from the removal of outliers and missing values,filtering on a specified dimension (e.g., a smaller time period), etc.

The file File._Bk can be determined to include treated data based on thedata in the file File_Aj if the two files have the same numbers of rowsand fields, but some cells have different values. In particular, if anumber of fields above some threshold (e.g., 80%) including dimensionfields are identical, the different values in a few cells can indicatethat missing values were filled in, type mismatches were set to NULL(for example, age field that mostly contains numbers, but has somestrings like ‘N/A’, ‘Unknown’, etc.), and/or certain values aretypically replaced with other values.

Dimension fields are one or more fields designated as dimension fields.In general, the fields that can be used to identify whether data indifferent files is overlapping or not can be designated as dimensionfields. In some implementations, time and geographic fields areautomatically recognized as dimensional and designated automatically asdimension fields by default. A user can change this designation and/ordesignate other fields (e.g., product id, office id, manufacturer,etc.), as dimensional fields. If dimension fields are different, thendata can be determined to be different. For example, if one file hasstate=NY and the other file has state=CA, the data can be considered tobe different. On the other hand, if balance is different, and if balanceis not designated as a dimension field, the two files are determined tolikely provide different versions of the same data.

Deduping is a common technique where duplicates are removed from a file.For example, there may be multiple entries for the same person in theaddress book and deduping operation will consolidate them into a singleentry. Deduping can be detected if the two files have the same number offields, one of the files has more rows, but the no-unique fields are nowmore-unique (in the example above, the number of contacts is smaller,but the names are more unique—i.e., contain fewer duplicates). If thefiles File_Aj and File_Bk have about the same number of fields, File_Bkcan include values that are aggregated along one or more dimensions.

The file File_Bk can be a join of the file File_Aj and another file orfiles, if File_Bk includes the fields from File_Aj and one or more otherfiles, and the number of rows of File_Bk results from a join of one ormore dimensions, e.g., inner, left outer, right outer, full outer, etc.,of the file File_Aj and the other files. In general, in a join ondimensional fields the rows where the dimensional values are the sameare concatenated. For example, if one file has a record with customerid5, timestamp Jan. 1, 2012, and balance=1000, and the other file has arecord with customerid 5, timestamp Jan. 1, 2012, and salesperson=‘Bob,’a join on customerid and timestamp can be performed to create a recordthat has both the balance and the salesperson, i.e., the record:customerid=5, timestamp Jan. 1, 2012, balance 1000, andsalesperson=‘Bob.’ Inner, outer, etc. joins can be used to perform ajoin where one file has a row with values that do not exist in the otherfile.

Finally, the file File_Bk can be a union of the file File_Aj and one ormore other files, if File_Bk has the same schema (i.e., same fields) andthe rows of File_Bk include the rows from File_Aj and the other files.For example, consider two files FA and FB, each one having two fieldsand two rows. Thus. FA has fields (C1, C2) with rows (values) (1, 1) and(2, 2), and FB has fields (X, Y) with values (1, 0) and (3, 4). A unionof FA and FB can be a table with two fields and four rows: (1, 1); (2,2); (1, 0): and (3, 4). In a union, in some implementations, the fieldsare assumed to match positionally, such that two or more files can beconcatenated. A join of FA and FB can have one, two, three, or fourfields, and none through four rows depending on the join condition. Forexample, if the join is performed on FA.C1=FB.X, and fields C1, C2 and Yare selected, the join would have one row with fields (C1, C2, Y)=(1, 1,0). In various implementations, if one or more of these patterns areobserved for the candidate pair (File_Aj, File_Bk), a high data scorecan be assigned thereto in the step 258, indicating that File_Bk waslikely derived from File_Aj.

In step 260 schema based analysis is performed to compute a schema-basedlineage score/measure for the candidate pair (File_Aj, File_Bk). Ingeneral, if File_Aj and File_Bk have substantially the same schema theyare likely related, i.e., File_Bk is either derived from File_Aj, or, inthe alternative, the two files can represent independent datacollections. If the two files contain fields with same signatures (oroverlap of fields), File_Bk can have been derived from File_Aj and, assuch, a high schema score can be assigned to the pair (File_Aj, File_Bk)in the step 260. A field signature can include one or more of field datatype, field length, a pattern, statistical analysis of the valuesincluding min, max, average and, for numeric or temporal values, meanand standard deviation. The signature can also include some or all ofthe data values (may be a number of most common values or somerepresentative compressed format that represents the values such as abitmap or CRC or some other way to quickly telling if two fields containthe same values). A field pattern is a format representation. Forexample, for a social security number (SSN), a pattern is NNN-NN-NNNN. Apattern or format can be a regular expression that describes what thedata looks like. Also, if the two files are two independent datacollections (“dumps”), they can still have substantially identicalsignatures as the data types and lengths can match. Substantiallysimilar field signatures can imply field overlap. Generally, schema candescribe rules that define a data element (e.g., cars can have make,model, color, and total mileage, and a car-rental record can have a car,rented flag, renters name, date of rental, and duration of rental. If itis determined that two files are not independent data collections, thefact that those two files have identical or substantially similar schemacan indicate that one file was derived from the other. Substantiallysimilar schemas, substantially similar field signatures, and/orsignificant value overlap generally imply a possibility that one file isderived from another.

By way of illustration and with reference to FIG. 3, a file 302 includesfour fields: name 304 a, addr 304 b, sales 304 c, and discount 304 d.Signatures 306 a-306 d are computed for each of these fields. Anotherfile 308 includes three fields: name 310 a, addr 310 b, and sales inlast six months 310 c. Signatures 312 a-312 c are computed for each ofthese fields of the file 308, as well. A schema score can be computedbased on a comparison of the field signatures 306 a-306 d with the fieldsignatures 312 a-312 c. If the file 302 includes sales and thecorresponding discounts in the last five-years period, and if the file308 is derived from the file 302 by selecting the sales in the last sixmonths, the later file can have significantly fewer rows and/or fieldsthan the file 302. If the fields in smaller file generally match thefields in the larger file and if the field signatures match, it can bedetermined that the smaller file is a subset of the larger file. Incomparing field signatures, fields with low cardinality (i.e., smallnumber of values, e.g., gender), likely have very similar signatures.For example, all genders are likely present in both a file with 100million records and a subset thereof with only 10 million records.Fields with high cardinality can be compared to determine if theyrepresent a subsets of fields in larger file based on min, max, mostcommon values, etc.

Referring back to FIG. 2B, in step 262 the formats of the files in thecandidate pair (File_Aj, File_Bk) are compared to assign a format scoreto the pair. Substantially similar formats can indicate that File_Bk isa copy of File_Aj, though two unrelated files can also have the sameformat if one or both of those files are obtained via format conversionfrom other, unrelated files. Here again, format comparison can be just astarting point and that the actual determination of whether File_Bk wasactually derived from File_Aj generally needs data/content analysis. Adetermination that two files have different format, however, does notnecessarily imply that one file cannot be derived from the other. Twodifferent files having different formats (e.g., a JSON file and an XMLfile) can be profiled separately and then the fields signatures can becompared.

It should be understood that in different implementations, one or moreof the steps 252-262 can be skipped, i.e., a particular score associatedwith a step is not computed and not used in determining lineage. Also,in different implementations, some or all of the steps 252-262 can beperformed in different orders. The scores computed in different stepscan be aggregated. e.g., as a sum, average, weighted average, etc., toobtain a lineage score for the evaluated candidate pair in the step 206(depicted in FIG. 1A).

In some implementation, after computing lineage scores and derivinglineage chains, a lineage graph is built. The roots and leaves of thegraph are designated as non-temporary files. The filename can also beanalyzed, e.g., to test if the name includes strings “temp” or “tmp”and/or the characters “,” “$,” etc., to determine whether a file istemporary. Based on the sub-directories in which the root, leaf, andintermediate files are stored, those sub-directories can be designatedas “landing,” “work,” or “production.” In general, the filescorresponding to the intermediary nodes or those stored in the “work”subdirectory are determined to be temporary unless one or more of thefollowing conditions are satisfied.

An intermediate file that has more than a specified number (e.g., five,seven, ten, etc.) of direct descendants (i.e., files directly derivedfrom the intermediate file) can be considered a non-temporary file. Forexample, with reference to FIG. 4, a file 402 is derived from the file404, and each of files 406 a, 406 b, 406 c is derived from theintermediate file 402. If the specified threshold is at least threedescendants, the file 402 is not designated as a temporary file. If thethreshold is four or greater, the intermediate file 402 is designated asa temporary file. If an intermediate file is used in a join operation(described above) with two or more files, that file can be designated asnon-temporary. Additionally or in the alternative, if the descendants ofan intermediate file are located in different sub-directories, thatintermediate file can be designated as non-temporary.

In some implementations, the designation of files as temporary or thedesignation of a sub-directory as “work” can be used to optimizestorage. For example, a user-specified storage policy can be applied topurge, archive, i.e., locate elsewhere, and/or compress the temporaryfiles. The scope of the specified action can be limited to the fileslocated in a specified sub-directory and/or files that have not beenread for a certain specified time and/or updated for a specified time.

With reference to FIG. 5A, a timestamp based ordering of various files502 at times t1 through t7 includes files 502 a-502 e. With reference toFIG. 5B, the candidate pairs 504 associated with the file 502 d includea pair (502 a, 502 d) 504 a, a pair (502 b, 502 d) 504 b, and a pair(502 c, 502 d) 504 c. The candidate pairs 506, depicted in FIG. 5C, areassociated with the file 504 b, and include the pair (502 a, 502 b) 506a. Similarly, as depicted in FIG. 5D, the candidate pairs 508 associatedwith the file 502 e include a pair (502 c, 502 c) 508 a and a pair (502d, 502 e) 508 b. Table 510, depicted in FIG. 5E lists the lineagescores, computed as described above, for each of these candidate pairs.Based on an analysis of these scores a lineage diagram 512 is generatedas depicted in FIG. 5F. The lineage diagram indicates that the file 502d is derived from the files 502 a, 502 b. The lineage diagram 512 alsoshows that the file 502 d is derived directly from the file 502 b, whichis derived directly from the file 502 a. As seen in the lineage diagram,the file 502 e is derived directly from the file 502 c.

Format Discovery

Different sources, such as people and computers, can supply data to adata lake in many different formats. A format is a standard way thatinformation is encoded for storage in an electronic file or data stream.The tabular or row-major format is a common format in which conventionaltables including rows and fields are stored as values for all fields forthe first row, followed by values for all fields for the second row andso on. Optionally, before storing the values, names of the fields canalso be stored. Other common formats include fieldar, name-value,nested-structured, forms, and free text. In tabular files, there istypically a field delimiter, row delimiter, and the first row canoptionally contain field names. For other formats, variousrepresentations exist including delimiters, separate structuredefinitions, or tags. For example, popular Parquet fieldar format storesdata in row, field, value tuples organized by fields. XML or JSON filesare self describing and contain tags that contain file names andbrackets or delimiters to signify hierarchy. For files in irregular, butrepeating format—such as log files, or for free-form text files, theuser can provide regular expressions that can extract fields ofinterest.

These and other file formats generally describe one or more fields in afile. Any field typically has the following attributes: name, length(i.e., length of the data corresponding to that field), type (i.e., typeof data associated with the field), empty (i.e., whether a file can beempty), description (which can be textual information about the field),tags (that can be used to categorize one or more fields and/or records,e.g., #customer, #PII, etc.), and identities (i.e., terms from commonbusiness glossary that has names and descriptions as well as industryontologies, e.g., @customer_name;@financial_services.banking.clients.tax_id.US).

Data inventory's repository can rtain all available information aboutthe files such as name, description (as textual information), provenance(where did it come from), and tags (to categorize, e.g., #customer,#CRM, etc.). In various implementations, when a file is supplied to thedata lake it is automatically profiled (e.g., by the inventory module108 of FIG. 1A) and all the information about the file is uploaded to athe data inventory's repository which can be a local repository on acluster. Only common information such as tag definitions, file formatdefinitions, etc., is generally stored in a registry and is sharedbetween users and companies. All information local to a company/clusteris often stored in a local repository. This can include all userspecified metadata, a certain number (e.g., 200, 500, 1000, etc.) ofmost frequent values for each field and a certain number (e.g., 200,500, 1000, etc.) of least frequent values for each field, and allpossible formats for each field, as well as a minimum and maximum valuesfor a field, number of unique values (also called cardinality), numberof null (empty) values, number of non-null (not empty) values, and ameasure of uniqueness of the field called selectivity defined ascardinality/number of non-null values. For numeric fields, one or moredistributions of field values such as mean and first, second, andthird-order standard deviations can also be uploaded to the commonformat repository. This information can be collected for fields in anytype of file. For example, for tabular and columnar files, it iscollected for each column. For files containing name-value pairs, it iscalculated for each unique name and the statistics are computed acrossall the values for that name. For hierarchical files like XML and JSON,each unique XPATH (a ‘/’ separate list of parent nodes for each nodethat contains values), is generally considered a unique field. Someimplementations can provide a single repository for all data and/ormetadata.

In one implementation, when a new file in an unknown format is submittedfor discovery, the system analyzes the file to see if it matches any ofthe specified formats. To this end, the system first tries to apply anumber of known formats (e.g., CSV, JSON, XML, etc.). If all of theapplied, i.e., tested formats cause parsing errors, the system attemptsto extract the file format. This is accomplished, at least in part, byidentifying delimiters, i.e., frequently occurring unusual characters inthe file, that can correspond to a format. To determine whether the filehas a positional format, the system can test if certain characters arefrequently found at the same positions, e.g., at the same line and fieldnumbers. Thereafter, the system checks if the extracted file formatmatches any custom parsing formats already associated with the dataplatform (e.g., custom formats in HCatalog on the cluster) or aredefined in a metadata repository. If a match is found, a custom parsercorresponding to the matching format can be applied. If that parsercauses parsing errors, however, the user can be prompted to manuallydefine the file format.

In one implementation, once the format becomes known, whether discoveredautomatically or specified by the user, the system profiles the file andsearches for matching patterns and values in the database of knownformats and patterns. Based on, at least in part, any matches the systemcan propose all applicable tags and identities. For example, if thefield contains values of format NNN-NN-NNNN it can match tags for #SSN,#TAXID.US etc. If a field has values such as John, Mary, Robert, Salil,the system can match tags #FirstName.

FIG. 6A depicts an example process 600 for format discovery. Theoperations described in FIG. 6A can be implemented by one or more dataprocessing apparatus connected by one or more computer networks. Thedata processing apparatus can reside in the same or in differentgeographic locations. One or more candidate parsers are identified instep 602 (e.g., by the inventory module 108 of FIG. 1A). Each of theseparsers can parse a specific file format (e.g., CSV, XML, custom format,etc.) and can retrieve data stored in that specific format. One or moreof these parsers can also generate schema by parsing the file. Exemplaryformats include JavaScript Object Notation, eXternal Markup Language,comma separated values, a tabular schema, or name value pairs.

In step 604, for each candidate parser, one or more delimiters areidentified. The delimiters are special characters and typically have ahigh, i.e., frequent occurrence in files successfully parsed by theparser. The high occurrence can be an occurrence that exceeds aspecified threshold such as percentage of characters in the file. Insome implementations, one or more delimiters are non-alphanumericcharacters.

In step 606, a file having an unknown format is analyzed to determine adistribution of each of the delimiters identified in the step 604.Thereafter, in step 608, for each candidate parser a score representinga likelihood that the parser will successfully parse the file having theunknown format is computed. The score computation is based on, at leastin part, the delimiters of the candidate parser that were identified inthe step 604, and percentage of occurrence of those delimiters that wascomputed in step 606 The score can also be based, at least in part, onthe candidate parser's success rate. The success rate can be based on anumber of files in a collection of files the parser successfully parsedin the past. The next candidate parser is selected in step 610, and thesteps 604-610 are repeated until all candidate parsers are scored.

In one implementation, a high score indicates a greater likelihood thatthe parser to which the high score is designated can successfully parsethe file having the unknown format. Therefore, in step 612, thecandidate parsers are ordered according to the respective scores. Insteps 614, 616, each candidate parser is then applied to the file havingthe unknown format, in order, until the file is successfully parsed.

In some implementations, in step 618 the format of the file isassociated with the successful parser in a parser model. The successfulparser is the parser that successfully parsed the file the format ofwhich was initially unknown. If it is determined that another file hasthe same format, that other file can be parsed using the successfulparser first us there is a high probability that the successful parserwill correctly parse the other file as well. As such, a significantperformance improvement can be achieved in parsing the other filebecause a number of candidate parsers that would have been triedotherwise are not applied and the previously successful parser isapplied first.

In general, a candidate parser is determined to have parsed a filesuccessfully if the candidate parser generated a correct schema for thefile. All parsers are generally expected to conform to a standard APIsuch as a popular Hive input format and serde. If the parser does notreturn errors and serde returns non-empty values for at least somecolumns, the parser is considered to have parsed the data successfully.If several different parsers can parse the same file, the parser thatreturns the most non-null values can be chosen. Additional checks can beperformed to determine how well the parser schema matches the file suchas comparing the size of parsed values (i.e., all the values that werereturned as non-empty) to the size of the file. If only a small portionof the file was parsed successfully (e.g., <10, 20 or 30%), the file canbe considered as not parsed. Alternatively or in addition, thedetermination of whether a candidate parser parsed a file successfullycan depend on whether the parser generated schema element values thatconform to a correct schema for the file parsed. The correct schema canhave been identified by the parser itself, or can have been receivedfrom another source, such as from a human or from a repository.

In some implementations, a candidate parser can perform errorcorrection. For example, if the parser expects a numerical value butreads non-numerical value, the parser can record a default value, suchas a NULL value instead of the value actually read. In someimplementations, a candidate parser is determined to have parsed a filesuccessfully only if the number of parsing error corrections generatedby that parser does not exceed specified threshold (e.g., 5 correctionsper 100 lines, 8 corrections per 1000 tokens, etc.).

In some implementations, a user-specified regular expression isassociated with the parser. The score for that parser is updated ordetermined based on, at least in part, whether a string matching theregular expression occurs in the file being parsed, which can be usefulin parsing free form text files and log files. Some files can have fixedrow widths, e.g., the first ten characters can be field 1, the next fivecharacters can be field 2, etc. These files typically fill in anyremaining spaces in a field with space characters, so at the end of afield such as name, space characters are frequently found because namescan be of different lengths and many are shorter than the longestpossible name. The parser can also detect repeating strings and formats.For example, if alphabetical characters are followed by a same sizenumeric string, the parser can determine that the numeric stringcorresponds to a separate field. Thus, the parser score can also bedetermined, at least in part, based on a signature, i.e., a stringhaving several characters, that occurs frequently and in a same relativeposition in the files successfully parsed by the parser. As describedbefore, in various implementations success require no parsing errors andthat the parser returns non-null values. The frequency can be, forexample, at least once, at least four times, ten times, etc., in everyfile, in at least half of the files, etc. In testing a file having anunknown format, the parser score can be determined, at least in part,based on the number of occurrences of the signature string in therelative position in the file.

Some parsers can be better suited than others to parse files having apositional format. As such, the various files each having a positionalformat, at least some of which are different, and that were successfullyparsed by the parser are identified. If the number of the identifiedfiles exceeds a specified threshold (e.g., 50, 100, etc.), the parserscore can be increased or a high score can be designated to the parser.Additionally or in the alternative, the parser score can be based on, atleast in part, one or more positional format features of the file beingtested, i.e., the unknown format file. Such positional format featuregenerally include an occurrence of a particular data type at aparticular field in a number of rows in a file, an occurrence of a spaceseparator at a particular field, or an occurrence of a constant value ata particular field.

Process 640 depicted in FIG. 68 is an example of format and schemadiscovery. A new file can be discovered, e.g., in a cluster, in step642. Parsing the new file using one or more parsers in a database ofparsers known to have been successful in parsing previously read filesin the cluster is attempted in step 644. If the file is parsedsuccessfully, the corresponding schema is discovered in step 646, and isadded to a repository. The schema can be added to a catalogue (e.g.,Hcatalog), while avoiding duplicates, in step 648. If no parser wassuccessful in step 644, candidate parsers are selected from a parserregistry in step 650. One or more recognition rules can be used toselect the candidate parsers. If a parser selected from the parserregistry is successful, in step 652, the schema corresponding to thefile can be discovered and can be added to a schema repository. Theschema can also be added to a catalogue (e.g., Hcatalog) while avoidingduplicates, in step 648. If none of the parsers in the parser registryis successful, a catalogue (e.g., Hcatalogue) can be searched in step654 to find a parser that can successfully parse the new file. If such aparser is found, that parser can be added into a parser registry in step656, and steps 652, 648 can be repeated.

Process 670 depicted in FIG. 6C is another example of format and schemadiscovery. A new file can be discovered, e.g., in a cluster, in step672. Parsing the new file using one or more parsers in a database ofparsers known to have been successful in parsing previously read filesin the cluster is attempted in step 674. If the file is parsedsuccessfully, the corresponding schema is discovered in step 676, and isadded to a repository. The schema can be added to a catalogue (e.g.,Hcatalog), while avoiding duplicates, in step 678. If no parser wassuccessful in step 674, a catalogue (e.g., Hcatalogue) can be searchedin step 680 to find a parser that can successfully parse the new file.If such a parser is found, it is further determined in step 682 whetherthe parser is already included in a parser registry. If not, the parseris added to the registry in step 684. The schema corresponding to thefile can be discovered in step 686, and can be added to a schemarepository. The schema can also be added to a catalogue (e.g., Hcatalog)while avoiding duplicates, in step 678. If the parser was not found in acatalogue in step 680, a final attempt to file the parser in a parserregistry can be made in step 688. If such a parser is found, the steps686, 678 can be repeated.

Automatic Data Set Generation

In general in a data platform, data is stored, published, or accessed,e.g., via a query or subscription on an on-going basis. The data isusually contained in files that have formats and names. Ontologies canbe associated with the data, and typically additional information aboutthe data is derived from the metadata associated with the various datastructures such as files, tables, etc., and properties of thesestructures.

The data contained in a file can be organized according to variousdimensions. For example, the temporal dimension generally indicates adate/time at which a data element was recorded and/or updated, such assales in a certain quarter, month, date, stock price at a certain timeof the day, etc. Other exemplary dimensions include geographical dataand person-related data. The dimension can be explicitly or implicitlydefined by a user. Some of the fields in files are “dimensions” as in astar schema, i.e., the files include facts or transactions anddimensions or reference data. The semantic of a dimension field is thatthe field has the same meaning in each file, so these files can berelated to each other.

Some dimensions have grains. For example, the temporal dimension caninclude coarse grains such as annual, quarterly, and monthly data, othergrains such as weekly and daily data, and fine grains such as hourlydata, data collected at each second, and even at a fraction of a second.Geographic data can also have coarse grains such as continents andsub-continents and regions of countries, and relatively fine grains suchas a congressional district, a zip code, a street, etc. Depending on theactual value of a data element that is recorded and the correspondingdimension in which the data is to be stored and/or accessed, a grainconversion can occur. For example, a date associated with a data elementcan be converted into the corresponding month.

Data is often organized into one or more fields that have names andsynonyms. “Cell phone” and “Mobile phone no.” for example, aresynonymous field names. Each field can have valid values and synonymousvalues. For example, the field gender can have valid values male andfemale, and corresponding synonymous values “M,” and “F.” Synonymousfield names from different files can be translated so as to have asingle field name for a certain type of data. Similarly, synonymousvalues from the same and/or different files can be translated so thatidentical data values can be identified. The translations can be basedon a specified ontology. As described above, a dimension is a field thatis present in many files and that can be used to relate the data inthose files.

Various access methods can be associated with the data or data files.The access methods can be public (i.e., access is granted to public atlarge) or private (i.e., access is limited to authorized personnel). Theaccess can be provided to the files themselves, and/or to the data,e.g., via structured query language (SQL) and/or not only SQL (NOSQL)database management system (DBMS), and representational state transfer(REST) application program interfaces (APIs).

When data is initially collected, it can include missing, incomplete,erroneous, or illegal values. While storing and/or during subsequentaccess, the data platform can substitute such values with correspondingdefault values and/or with values computed based on other valid valuesin the file. The substitutions can be made using specified rules orrules that the platform derives by analyzing previoustranslations/modifications. These translations are different than atranslation from one synonym to another as described above.

In some implementations, a missing value of a field is left black, butin other implementations, the missing value is replaced with a mean ofthe other values corresponding to that field and/or a dimension.Alternatively, records or rows corresponding to the missing value can beremoved. Illegal values, in general, can include values of a wrong type,an out of band/range value, a value not specified in a list of legalvalues, etc. In some implementations, an illegal value is replaced withnull, default, or mean values, or the corresponding records/row areremoved. Outliers can include values that are different than the mean byabout N times the standard deviation. The multiple N can be 1, 2, 3,etc. In some implementations, the records/rows corresponding to anoutlier is removed. In other implementations only the records/rowshaving at least one outlier value are extracted. In yet otherimplementations, the outliers are considered to be illegal values, andcan be modified as described above. These values can be winsorized.

In some implementations, if an address is determined to be illegal(i.e., non-existing) that value is replaced with the closest legaladdress. Gender can be derived from first name and ethnicity can bederived from first and/or last name and place of birth. Data can also beanonymized in some implementations. For example, data can be made genderand ethnicity consistent by replacing real names with anonymous namesthat retain the gender and ethnicity. For example, a masculine Hispanicname like Jose, can be replaced with another masculine Hispanic namelike Pablo. Geographic data can be anonymized to values within aspecified range, e.g., within 5 miles, 10 miles, etc. Individual valuescan be randomized such that the total of the randomized values issubstantially the same as the total of the original values. For example,all individual salaries in a department can be replaced with randomsalaries, while substantially maintaining the total salary for thedepartment.

One or more of the above described transformation techniques can beapplicable to the data in a file, based on one or more conditionsassociated with the data. In an automatic data generation process 700depicted in FIG. 7A, previously applied transformations can be analyzed,a suitable transformation can be selected based on the analysis, andthat transformation can applied to a data element. The operationsdescribed in FIG. 7A can be implemented by one or more data processingapparatus connected by one or more computer networks. The dataprocessing apparatus can reside in the same or in different geographiclocations.

In one example, a data scientist trained a predictive model to predicthow much a house is going to sell for in Rochester, N.Y. She used a setof variables such as asking price, number of bedrooms, number ofbathrooms, comparable prior sales, etc. If the number of bathroom wasmissing, she would put 1 for a 0-2 bedroom house and 2 for a house withmore than 2 bedrooms. Now she wants to apply this model to sales inPrinceton, N.J. She gathered the sales information, and now, to run themodel, she needs to treat the data the same way it was treated when themodel was created. For example, if the number of bathrooms is missing,she needs to set it to 1 for 0-2 bedroom homes and 2 for >2 bedroomhomes or the model may not yield accurate results. The same transform(the setting missing number of bathrooms, in the example above), must beapplied if the data scientist wants to apply the model to all the newhomes for sale in Rochester, N.Y.

With reference to FIGS. 7B and 7C, in general, a user can create atraining file (TF) to train the model (M) and the set of transformations(TxSet) can be captured. When a new file (NF) is obtained, the same setof transformations (TxSet) is applied to the new file and then the model(M) is run on the transformed file to get results. Each of the filesmonitored in step 702 has a schema, such as schema 750 as depicted inFIG. 7D, and each schema includes one or more schema elements, e.g.,schema elements 752 a, 752 b, 752 c. Various types of values of a schemaelement, such as illegal values 754 a, missing values 754 b, outliervalues 754 c, and legal values 754 d of the schema elements 752 a-752 c,can have changed over time into respective modified values 756 a-756 d.These changes/modifications are also observed in the step 702.

By observing the modifications, the underlying transformation rules arederived in step 704. Each transformation rule generally specifies, for arespective schema element, how a value of a certain type of that schemaelement is to be modified. For example, as described above, thesemodifications can include replacement with a NULL, mean, or closet legalvalue according to derived rules R1 758 a, R2, 758 b, and R3 758 c. Themodifications can also include randomization while preserving the totalof the randomized values, according to a derived rule R4 758 d.

In step 706, a schema element is selected for each of several modelvariables. For each selected schema element, a file containing values ofthe selected schema element is selected in step 708. In step 710, one ormore values of the selected file are analyzed, and based on at least inpart, the schema element, the type of the value, and the value itself, asuitable transformation rule is selected. For example, the rule R2 758 bcan be selected if missing values are replaced by the mean, and the ruleR4 7584 can be selected if legal values are randomized.

The steps 708, 710 can be repeated for additional or all filescontaining values of the schema element selected in the step 706.Thereafter, the steps 706-710 can be repeated for additional schemaelements. In step 712 a new file is generated. The new file containsunmodified values from one or more files selected in step 708 and themodified values generated in the step 710, for each schema element.

It should be understood that implementations described with reference toFIGS. 7A and 7B are illustrative only and that the automatic data setgeneration process, in general, can analyze several schema, a number ofschema elements (e.g., 50, 100, 200 elements), and can derive and applyseveral rules (e.g., 10, 40, 150 rules).

Map Reduce

MapReduce is a software programming model composed of parallel mapperprocesses that perform filtering and sorting of data and parallelreducer processes that perform summary operations on the output, of themap processes. For example, many big-data storage and analysis systemsstore data using tuples, where each tuple includes a key and associatedvalues. In order to reduce data storage costs, one or more reducers areused where each reducer is assigned several tuples for reduction. Thereducer can achieve storage reduction, for example, by removing oldvalues (e.g., older than one year, or any other specified period),values determined to be unnecessary for subsequent analysis, etc. As thedata size increases, efficient utilization of reducers can be beneficialso that no one particular reducer is overburdened, while underutilizingother reducers.

To this end, with reference to FIG. 8, a number of mappers areconfigured to perform a map operation on respective input data togenerate a number of respective tuples (step 802). Each tuple can have arespective key and one or more respective data values. KC_(l) is a countof occurrences of a key K_(l) in the tuples, T is a count of the tuples,and R is a count of the reducers. For each key K_(i) from some or all ofthe keys, if

${{KC}_{i} \geq \frac{T}{R}},$

all tuples having K_(i) as a key are assigned to one of several reducersthat has no assigned tuples (step 804). Otherwise, if

${{KC}_{i} < \frac{T}{R}},$

all tuples having K_(i) as a key are assigned to reducer R_(j) of theseveral reducers (step 806). R_(j) is selected such that

${{{CR}_{j} + {KC}_{i}} < {{\frac{T}{R}\mspace{14mu} {and}\mspace{14mu} \frac{T}{R}} - \left( {{CR}_{j} + {KC}_{i}} \right)} < M},$

where CR_(j) is a count of tuples assigned to R_(j) and M is a selectedthreshold (step 806). Otherwise, i.e., when

${{KC}_{i} < \frac{T}{R}},$

but no R_(j) that satisfies the condition with threshold M was found,all tuples having K_(l) as a key are assigned to a reducer R_(k) havinga fewest number of assigned tuples (step 808). Each reducer, having oneor more tuples assigned thereto as described above, can perform a reduceoperation on the tuples assigned to that reducer to generate output data(step 810).

In some implementations, prior to selection of a key K_(i), the keys canbe ordered according to KCi from highest KCi to lowest. In step 802, thekey K_(i) can be selected from only those keys that have the number ofoccurrences greater than a second threshold N and the other keys whereKCi<N are distributed evenly among the remaining reducers. The thresholdN can be specified as

$N = {\left( \frac{T}{R} \right) \times c}$

where c is a specified constant. In some implementations, the firstthreshold M can be specified as

$M = {\left( \frac{T}{R} \right) \times c}$

where c is the specified constant.

In the optional step 812, for each unselected key K_(i), tuples havingK_(i) as a key can be assigned to a reducer R_(p) where p is a function(e.g., a hash function) of K_(i). The number of reducers R can bedesignated as

$R = \left\lceil \frac{T}{{KC}_{i}} \right\rceil$

wherein x is the reducer having the most tuples assigned thereto. Theseveral mappers can operate simultaneously so as to perform the mapoperation in parallel. Similarly, the several reducers can also operatesimultaneously so as to perform the reduce operation in parallel. Thus,several instances of steps 802, 810, and/or other steps can execute inparallel.

Contextual Metadata Navigation

Some implementations allow users to visualize a relationship between thevalues associated with a number of schema elements and one or moreattributes of the schema elements. A particular schema element can behierarchical, and can be a key, a name, an attribute, or a column. Thevalues can be called data and schema-element attributes can be calledmetadata. To facilitate an interaction therebetween, with reference toFIG. 9, a graphical user interface is provided in step 902. Theinterface has an interactive metadata display and an interactive datadisplay. A file having a schema that includes a number of schemaelements is selected in step 904. The file can contain several valuescorresponding to the different schema elements, e.g., names, addresses,grade level, GPA, type of service provided to a customer, credit limitoffered to a customer, etc. These values are presented on the datadisplay, in step 906. In step 908, for one or more of the schemaelements, respective metadata are presented on the metadata display.

The metadata can include one or more attributes that characterize valuesof the schema element, such as max, min, average, standard deviation,number of duplicates, number of values in certain ranges, etc. Ingeneral, an attribute of a particular schema element can include one ormore of a label, a data type of a particular schema element, a minimumvalue and a maximum value of the values of the particular schemaelement, a distribution of values of the particular schema element,frequent values of the particular schema element, a frequency of valuesof the particular schema element, a frequency of lengths of values ofthe particular schema element, a frequency of patterns of values of theparticular schema element, output of one or more hash functions appliedto values of the particular schema element, or a regular expression forthe values of the particular schema element.

In response to a user selecting one or more attributes of a particularschema element presented on the metadata display, the values in the filethat are presented on the data display for that schema element and thathave the selected attributes are highlighted in step 910. Thehighlighting can include changing color, background, and/or hiding thevalues of the file that do not have the selected attributes.Alternatively, or in addition, in response to a user selecting one ormore values of another schema element presented on the data display,attributes of the other schema element displayed on the metadata displaythat characterize the selected values are highlighted in step 912.

In some implementations, a number of files can be selected in the step904 and, correspondingly, data and metadata corresponding to differentfiles can be presented in the steps 906, 908, respectively. In addition,a name corresponding to a respective schema can also be displayed in themetadata display. In an optional step 914, in response to receiving userselection of one of the schema names in the metadata display,information about one or more files that have the selected schema can bedisplayed. The displayed information can include names of the files,corresponding file directory locations, and respective lineages of thefiles. Optionally, in step 908, one or more schema elements of theschema that corresponds to the selected schema name can be displayed onthe metadata display.

The metadata display and the interactive data display are presented onseparate display devices, each of which can be a smart phone, a tabletcomputer, a laptop computer, smart glasses, or a smart watch.

Metadata (Glossary) Registry

In order to decipher a large amount of data, it is often necessary toknow at least some aspects of the data, e.g., the meaning of at leastsome of the various data elements. It may be necessary to understand themeaning of data at the structural and/or field levels. Often, somepeople in the organization generating and/or using the data know themeaning of various data elements, and may record the meaning byannotating or tagging the data. These annotations can be an importantsource of metadata. Capturing this metadata and propagating it to thedata, as applicable, can benefit all users of the data.

Some implementations allow annotations provided by data scientists andother users to be retained as part of the metadata content. Theseannotations can then be used to enable search, data understanding, andmore fluent and accurate annotations. Generally, users tend to use theright terminology when creating annotations. While a stringent,consistent terminology usage can be enforced, such enforcement is oftendifficult if not improbable. The implementations of tagging andproviding annotations that are described herein incorporate a techniquethat can capture as much as possible of the user-specified annotationsand systematically progress towards increasingly higher levels ofuniformity.

Specifically, as part of automatic and extensive analysis, capture,upkeep, and dispense annotations and notes that the data scientists andother users create as part of data search, browsing, and wrangling. Tofacilitate automatic, universal sharing of these annotations, use termsto annotate data in displays and browsing, and provide these content,i.e., annotations, as a vocabulary to encourage further annotations.This can lead to a glossary that is crowd-sourced and open-sourced:annotations entered by analysts can be automatically considered as acontribution to the common glossary. This way the glossary can becreated bottom-up. Inconsistencies can be tolerated but can be resolvedasynchronously, so such correctness does not stop the users frommarching towards their goals. This technique is thus different from the“big bang” approach of creating common glossaries by standarddefinitions and standards committees such as HL7 for healthcareinterchange. The content of a glossary created in a bottom-up manner iscrowd soured in a fashion that can capture and maximize the knowledge ofthe analysts without burdening them.

Once there is some content in the glossary, it can be leveraged toenable data scientists to produce more normalized, more precise taggingand annotation of data in the inventory with common terms, e.g., usingterms that are common either inside or outside of enterprise. Taggingtwo different fields in two different files or databases with the sameterm can mean that these fields represent the same item and that theirdata has the same domain and units of measure. This processing andanalysis based on such tagging can provide for a functional, if notcompletely coherent glossary and allow the big data lake to stay clearand more coherent.

In one implementation such a glossary can be hosted with a multi-tenantcloud application. There can be many installations of a data analysissystem, but all users thereof can have access to the glossary cloud,where the content is managed and shared across all tenants. Thecrowd-sourced implementation can permit committers to generate thecontent and editors or stewards to review and approve the submissions,i.e., the generated content. Industry specific ontologies can be createdthrough crowdsourcing to organize various terms into coherent groupingsand to divide the name space, because the same terms may have verydifferent meaning in different industries or for different subjectswithin the same industry. Some implementations include both private andpublic glossaries. Users can use the shared (public) glossary by defaultbut can opt out to a private glossary. The system can facilitatereconciliation between public and private registries. For example, if apublic term X is called Y at a particular enterprise, Y can be a localsynonym of X and the data inventory with respect to that particularenterprise can automatically translate X to Y and vice versa when movingdata between providers that are internal to the particular enterpriseand external data providers.

A glossary with rich, crowded sourced content can be a valuable assetthat can be leveraged for other purposes. In some implementation, theglossary with data signatures is extended in support of schemadiscovery. Specifically, the terms, definitions, as well a set of datasignatures of the columns that are classified by each particular termcan be preserved in the glossary. The system thus has acquired knowledgeof the name (the term) of a set of items, and it can also memorize anumber of instances of these items, max, min, frequent values,distributions, regex, etc. Subsequently, if the system receives orlocates a file (e.g., a csv file) with no column headers, the system canuse the knowledge, acquired via previous analysis and stored in theglossary to attempt to give each column a header. For example, thesystem can determine that some of these columns are names of companies,their addresses, etc.

To this end, the data signatures of one or more columns, e.g., type,length, patterns, and/or combination thereof, etc. are computed. Thedata signature of a term can be a collection of column signatures ofcolumns designated or determined to be classified by that term. Aparticular column profile, of a column that does not have a label, canthen be matched with term data signatures to provide a ranked list ofpossible matching terms, with computed confidence levels. One of theseterms determined to be the best match can then be designated as a labelto that particular column.

Specifically, with reference to FIG. 10, for each one of a number offiles, one or more respective schema elements in the file are selected,and a respective signature for the selected schema element is determined(step 1002). The signature is a characterization of several values ofthe schema element in the selected file. For each one of severalglossary terms, the glossary term is associated with the signatures ofone or more of the schema elements if each of those elements has aschema element label that matches the glossary term (step 1004). Thematching in step 1004 can include calculating an edit distance betweenthe label and the glossary term, and determining that the label matchesthe glossary term based on the edit distance not exceeding a specifiedthreshold. A label can also be determined to match a glossary term ifthe label is a synonym of the glossary term. To facilitate this match,synonyms of one or more glossary terms can be specified by a user.

A first schema element of one of the several files is identified suchthat the schema element does not have a schema element label (step1006). A glossary term associated with a signature that matches asignature of a schema element that does not have a label is selected asa suggested schema element label for that schema element (step 1008). Amatch between the two signatures can be based on respective types of theschema element data values, frequency of the types, range of the datavalues, distribution of the data values, format of the data values,length of the data values, overlap in the data values, and overlap inmost common data values.

In some implementations, selecting a glossary term as a suggested schemaelement label for a particular schema element can include identifyingseveral glossary terms that are associated with respective signaturesthat match the signature of that particular schema element, andselecting one of those glossary terms based on one or more criteria suchas, e.g., a count of times that the glossary term is used as a schemaelement label in the various files.

In some implementations, in an optional step 1010, the selected glossaryterm is provided as a suggested label for a particular schema elementlacking a label, and user input accepting or rejecting the suggestedlabel is received. One or more glossary terms can occurs as a schemaelement label in a number of different files associated with a number ofdifferent users.

A particular schema element can be an eXtensible Markup Language (XML)fragment, a JavaScript Object Notation (JSON) structure, a Graph DBgraph, a portion of a relational, columnar, in-memory or non-relationaldatabase, an object store schema element, or a log file. A particularschema element can be hierarchical, or a key, a name, an attribute, or acolumn. A particular schema element can also be a column field and thesignature of the particular schema element can include one or more ofthe following: a data type of a particular schema element, a minimumvalue and a maximum value of the values of the particular schemaelement, a distribution of values of the particular schema element,frequent values of the particular schema element, a frequency of valuesof the particular schema element, a frequency of lengths of values ofthe particular schema element, a frequency of patterns of values of theparticular schema element, output of one or more hash functions appliedto values of the particular schema element, and a regular expression forthe values of the particular schema element.

The profiling technique described herein is applicable to bothrelational schema (e.g., schema associated with a file having row-columnformat where each column can represent a schema element) andnon-relational schema (e.g., schema associated with XML, JSON, Graph DB,big table, etc.). In the case of non-relational schema, the signaturesof schema elements can include various attributes instead of or inaddition to the common attributes (e.g., minimum and maximum values,variance, etc.) of the schema elements in a relational schema. Aparticular schema element can be an XML fragment or a JSON structure,and the signature of that particular schema element can include one ormore of the following: elements, attributes. Uniform Reference Locators,XPATH, dependencies between element values and presence of otherelements, average element depth, minimum element depth, maximum elementdepth, element frequency, bad elements, constant elements, impliednulls, profile of element values, and references to other files.

A particular schema can be element a GraphDB graph, and the signature ofthat particular schema element can include one or more of the followingaverage graph depth, disconnected nodes in the graph, most connectednodes in the graph, a count of islands in the graph, sizes of islands inthe graph, sizes of the biggest and smallest islands in the graph, anaverage size of an island in the graph, and counts of nodes havingdifferent respective numbers of connections.

A particular schema element can be a portion of a name-value or bigtable database, and the signature of the particular schema element canbe based on one or more of the following attributes the schema elementdata values: cardinality, nulls, functional dependencies between columnvalues and between presence of various columns, least frequent columns,empty columns, constant columns, column groups, minimum, average andmaximum number of columns having values, number of columns, and keycolumns for each column group.

In some implementations, a particular schema element can be a name-valueor big table database column that includes one or more of commaseparated values, a JSON object, or an XML document. A particular schemaelement can also be a log file, and the signature of the particularschema element can include one or more of tags, most frequent messages,minimum, average and maximum time between messages, and common fields.

FIG. 11A depicts an example of a profile of columns of data representedin columnar format. Various attributes such as type, length,classification, max, min, mode, median, uniqueness, null (indicatingwhether a row includes at least one null value, at least a specifiednumber of null values, etc.), non-null uniqueness, cardinality,frequency of values (e.g., a histogram), and pattern frequency, itshould be understood that the attributed listed above are examples onlyand that different implementations can include fewer, more, and/ordifferent attributes. For one or more attributes, the correspondingvalues, as shown in FIG. 11A, can also be identified.

FIG. 11B depicts an example of a profile of non-tabular (e.g., NoSQL)data. While some attributes are the same as that shown in FIG. 11A, theschema elements in non-tabular data can be hierarchical. For example, anorder can have attributes such as an order ID, a shipping address, and alist of ordered items. A shipping address, can include attributes suchas a street address, a state, and a zipcode, and an ordered item canhave attributes such as an item name, price, etc. As such, the profileof the data depicted in FIG. 11B can include an attribute depth. Also,the values of the attributes of a particular schema element, e.g.,orders, can represent values of the attributes of the associatedsub-schema. One or more attributes of orders, for example, can bederived from one or more attributes of items, which is a sub-schemaelement of the schema element orders. In some implementations, theschema elements, the corresponding sub schema elements, the attributesof one or more sub schema elements, and attributes of schema elementsthat are based on the attributes of the corresponding sub schemaelements are computed.

Embodiments of the subject matter and the operations described in thisspecification can be implemented in digital electronic circuitry, or incomputer software, firmware, or hardware, including the structuresdisclosed in this specification and their structural equivalents, or incombinations of one or more of them. Embodiments of the subject matterdescribed in this specification can be implemented as one or morecomputer programs, i.e., one or more modules of computer programinstructions, encoded on computer storage medium for execution by, or tocontrol the operation of, data processing apparatus. Alternatively or inaddition, the program instructions can be encoded on anartificially-generated propagated signal, e.g., a machine-generatedelectrical, optical, or electromagnetic signal, that is generated toencode information for transmission to suitable receiver apparatus forexecution by a data processing apparatus. A computer storage medium canbe, or be included in, a computer-readable storage device, acomputer-readable storage substrate, a random or serial access memoryarray or device, or a combination of one or more of them. Moreover,while a computer storage medium is not a propagated signal, a computerstorage medium can be a source or destination of computer programinstructions encoded in an artificially-generated propagated signal. Thecomputer storage medium can also be, or be included in, one or moreseparate physical components or media (e.g., multiple CDs, disks, orother storage devices).

The operations described in this specification can be implemented asoperations performed by a data processing apparatus on data stored onone or more computer-readable storage devices or received from othersources.

The term “data processing apparatus” encompasses all kinds of apparatus,devices, and machines for processing data, including by way of example aprogrammable processor, a computer, a system on a chip, or multipleones, or combinations, of the foregoing The apparatus can includespecial purpose logic circuitry, e.g., an FPGA (field programmable gatearray) or an ASIC (application-specific integrated circuit). Theapparatus can also include, in addition to hardware, code that createsan execution environment for the computer program in question, e.g.,code that constitutes processor firmware, a protocol stack, a databasemanagement system, an operating system, a cross-platform runtimeenvironment, a virtual machine, or a combination of one or more of them.The apparatus and execution environment can realize various differentcomputing model infrastructures, such as web services, distributedcomputing and grid computing infrastructures.

A computer program (also known as a program, software, softwareapplication, script, or code) can be written in any form of programminglanguage, including compiled or interpreted languages, declarative orprocedural languages, and it can be deployed in any form, including as astand-alone program or as a module, component, subroutine, object, orother unit suitable for use in a computing environment. A computerprogram may, but need not, correspond to a file in a file system. Aprogram can be stored in a portion of a file that holds other programsor data (e.g., one or more scripts stored in a markup languageresource), in a single file dedicated to the program in question, or inmultiple coordinated files (e.g., files that store one or more modules,sub-programs, or portions of code). A computer program can be deployedto be executed on one computer or on multiple computers that are locatedat one site or distributed across multiple sites and interconnected by acommunication network.

The processes and logic flows described in this specification can beperformed by one or more programmable processors executing one or morecomputer programs to perform actions by operating on input data andgenerating output. The processes and logic flows can also be performedby, and apparatus can also be implemented as, special purpose logiccircuitry, e.g., an FPGA (field programmable gate array) or an ASIC(application-specific integrated circuit).

Processors suitable for the execution of a computer program include, byway of example, both general and special purpose microprocessors, andany one or more processors of any kind of digital computer. Generally, aprocessor will receive instructions and data from a mad-only memory or arandom access memory or both. The essential elements of a computer are aprocessor for performing actions in accordance with instructions and oneor more memory devices for storing instructions and data. Generally, acomputer will also include, or be operatively coupled to receive datafrom or transfer data to, or both, one or more mass storage devices forstoring data, e.g., magnetic, magneto-optical disks, or optical disks.However, a computer need not have such devices. Moreover, a computer canbe embedded in another device, e.g., a mobile telephone, a personaldigital assistant (PDA), a mobile audio or video player, a game console,a Global Positioning System (GPS) receiver, or a portable storage device(e.g., a universal serial bus (USB) flash drive), to name just a few.Devices suitable for storing computer program instructions and datainclude all forms of non-volatile memory, media and memory devices,including by way of example semiconductor memory devices, e.g., EPROM,EEPROM, and flash memory devices; magnetic disks, e.g., internal harddisks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROMdisks. The processor and the memory can be supplemented by, orincorporated in, special purpose logic circuitry.

To provide for interaction with a user, embodiments of the subjectmatter described in this specification can be implemented on a computerhaving a display device, e.g., a CRT (cathode ray tube) or LCD (liquidcrystal display) monitor, for displaying information to the user and akeyboard and a pointing device, e.g., a mouse or a trackball, by whichthe user can provide input to the computer. Other kinds of devices canbe used to provide for interaction with a user as well; for example,feedback provided to the user can be any form of sensory feedback, e.g.,visual feedback, auditory feedback, or tactile feedback; and input fromthe user can be received in any form, including acoustic, speech, ortactile input. In addition, a computer can interact with a user bysending resources to and receiving resources from a device that is usedby the user, for example, by sending web pages to a web browser on auser's client device in response to requests received from the webbrowser.

Embodiments of the subject matter described in this specification can beimplemented in a computing system that includes a back-end component,e.g., as a data server, or that includes a middleware component, e.g.,an application server, or that includes a front-end component, e.g., aclient computer having a graphical user interface or a Web browserthrough which a user can interact with an implementation of the subjectmatter described in this specification, or any combination of one ormore such back-end, middleware, or front-end components. The componentsof the system can be interconnected by any form or medium of digitaldata communication, e.g., a communication network. Examples ofcommunication networks include a local area network (“LAN”) and a widearea network (“WAN”), an inter-network (e.g., the Internet), andpeer-to-peer networks (e.g., ad hoc peer-to-peer networks).

The computing system can include clients and servers. A client andserver are generally remote from each other and typically interactthrough a communication network. The relationship of client and serverarises by virtue of computer programs running on the respectivecomputers and having a client-server relationship to each other. In someembodiments, a server transmits data (e.g., an HTML page) to a clientdevice (e.g., for purposes of displaying data to and receiving userinput from a user interacting with the client device). Data generated atthe client device (e.g., a result of the user interaction) can bereceived from the client device at the server.

A system of one or more computers can be configured to performparticular operations or actions by virtue of having software, firmware,hardware, or a combination of them installed on the system that inoperation causes or cause the system to perform the actions. One or morecomputer programs can be configured to perform particular operations oractions by virtue of including instructions that, when executed by dataprocessing apparatus, cause the apparatus to perform the actions.

While this specification contains many specific implementation details,these should not be construed as limitations on the scope of anyinventions or of what may be claimed, but rather as descriptions offeatures specific to particular embodiments of particular inventions.Certain features that are described in this specification in the contextof separate embodiments can also be implemented in combination in asingle embodiment. Conversely, various features that are described inthe context of a single embodiment can also be implemented in multipleembodiments separately or in any suitable subcombination. Moreover,although features may be described above as acting in certaincombinations and even initially claimed as such, one or more featuresfrom a claimed combination can in some cases be excised from thecombination, and the claimed combination may be directed to asubcombination or variation of a subcombination.

Similarly, while operations are depicted in the drawings in a particularorder, this should not be understood as requiring that such operationsbe performed in the particular order shown or in sequential order, orthat all illustrated operations be performed, to achieve desirableresults. In certain circumstances, multitasking and parallel processingmay be advantageous. Moreover, the separation of various systemcomponents in the embodiments described above should not be understoodas requiring such separation in all embodiments, and it should beunderstood that the described program components and systems cangenerally be integrated together in a single software product orpackaged into multiple software products.

Thus, particular embodiments of the subject matter have been described.Other embodiments are within the scope of the following claims. In somecases, the actions recited in the claims can be performed in a differentorder and still achieve desirable results. In addition, the processesdepicted in the accompanying figures do not necessarily require theparticular order shown, or sequential order, to achieve desirableresults. In certain implementations, multitasking and parallelprocessing may be advantageous.

What is claimed is: 1-27. (canceled)
 28. A computer-implemented methodcomprising: determining, for each of a plurality of files and one ormore respective schema elements in the file, a respective signature forthe schema element, wherein the signature is a characterization of aplurality of values of the schema element in the file; for each of aplurality of glossary terms, associating the glossary term with thesignatures of one or more of the schema elements that each have arespective schema element label that matches the glossary term;identifying a first schema element of one of the plurality of files thatdoes not have a respective schema element label; and selecting aglossary term associated with a signature that matches a signature of afirst schema element as a suggested schema element label for the firstschema element.
 29. The method of claim 28 wherein associating theglossary term with the signatures of one or more of the schema elementsthat each have a respective schema element label that matches theglossary term comprises: calculating an edit distance between the labeland the glossary term; and determining that the label matches theglossary term based on the edit distance not exceeding a threshold. 30.The method of claim 28 wherein associating the glossary term with thesignatures of one or more of the schema elements that each have arespective schema element label that matches the glossary termcomprises: determining that the label matches the glossary term if thelabel is a synonym of the glossary term.
 31. (canceled)
 32. The methodof claim 28 wherein selecting a glossary term associated with asignature that matches a signature of a first schema element as asuggested schema element label for the first schema element comprises:determining that the signature matches the signature of the first schemaelement based on one or more of: respective types of the first schemaelement data values, frequency of the types, range of the data values,distribution of the data values, format of the data values, length ofthe data values, overlap in the data values, and overlap in most commondata values. 33-34. (canceled)
 35. The method of claim 28, furthercomprising: providing the selected glossary term as a suggested labelfor the first schema element; receiving user input accepting orrejecting the suggested label.
 36. The method of claim 28 wherein eachof the plurality of glossary terms occurs as a schema element label in arespective plurality of different files associated with a respectiveplurality of different users, wherein a count of the plurality of usersexceeds a threshold.
 37. The method of claim 28 wherein a particularschema element is an eXtensible Markup Language (XML) fragment, aJavaScript Object Notation (JSON) structure, a Graph DB graph, a portionof a relational, columnar, in-memory or non-relational database, anobject store schema element, or a log file.
 38. The method of claim 28wherein a particular schema element is hierarchical, a key, a name, anattribute, or a column.
 39. The method of claim 28 wherein theparticular schema element is a column field and wherein the signature ofthe particular schema element comprises a plurality of the following: adata type of a particular schema element, a minimum value and a maximumvalue of the values of the particular schema element, a distribution ofvalues of the particular schema element, frequent values of theparticular schema element, a frequency of values of the particularschema element, a frequency of lengths of values of the particularschema element, a frequency of patterns of values of the particularschema element, output of one or more hash functions applied to valuesof the particular schema element, and a regular expression for thevalues of the particular schema element. 40-43. (canceled)
 44. Themethod of claim 28 wherein the particular schema element is a log fileand wherein the signature of the particular schema element comprises aplurality of the following: tags, most frequent messages, minimum,average and maximum time between messages, and common fields.
 45. Acomputer-implemented method comprising: determining, for each of aplurality of files and one or more respective schema elements in thefile, a respective signature for the schema element, wherein thesignature is a characterization of a plurality of values of the schemaelement in the file; for each of a plurality of glossary terms,associating the glossary term with the signatures of one or more of theschema elements that each have a respective schema element label thatmatches the glossary term, wherein a particular schema element is aneXtensible Markup Language (XML) fragment, a JavaScript Object Notation(JSON) structure, a Graph DB graph, a portion of a relational, columnar,in-memory or non-relational database, an object store schema element, ora log file; identifying a first schema element of one of the pluralityof files that does not have a respective schema element label; andselecting a glossary term associated with a signature that matches asignature of a first schema element as a suggested schema element labelfor the first schema element.
 46. The method of claim 45 whereinassociating the glossary term with the signatures of one or more of theschema elements that each have a respective schema element label thatmatches the glossary term comprises: calculating an edit distancebetween the label and the glossary term; and determining that the labelmatches the glossary term based on the edit distance not exceeding athreshold.
 47. The method of claim 45 wherein associating the glossaryterm with the signatures of one or more of the schema elements that eachhave a respective schema element label that matches the glossary termcomprises: determining that the label matches the glossary term if thelabel is a synonym of the glossary term.
 48. (canceled)
 49. The methodof claim 45 wherein selecting a glossary term associated with asignature that matches a signature of a first schema element as asuggested schema element label for the first schema element comprises:determining that the signature matches the signature of the first schemaelement based on one or more of: respective types of the first schemaelement data values, frequency of the types, range of the data values,distribution of the data values, format of the data values, length ofthe data values, overlap in the data values, and overlap in most commondata values.
 50. The method of claim 45 wherein selecting a glossaryterm associated with a signature that matches a signature of a firstschema element as a suggested schema element label for the first schemaelement comprises: identifying a plurality of glossary terms that areassociated with respective signatures that match the signature of thefirst schema element; and selecting one of the plurality of the glossaryterms based on one or more criteria.
 51. (canceled)
 52. The method ofclaim 45, further comprising: providing the selected glossary term as asuggested label for the first schema element; receiving user inputaccepting or rejecting the suggested label.
 53. The method of claim 45,wherein each of the plurality of glossary terms occurs as a schemaelement label in a respective plurality of different files associatedwith a respective plurality of different users, wherein a count of theplurality of users exceeds a threshold.
 54. The method of claim 45,wherein a particular schema element is hierarchical, a key, a name, anattribute, or a column.
 55. The method of claim 45, wherein theparticular schema element is a column field and wherein the signature ofthe particular schema element comprises a plurality of the following: adata type of a particular schema element, a minimum value and a maximumvalue of the values of the particular schema element, a distribution ofvalues of the particular schema element, frequent values of theparticular schema element, a frequency of values of the particularschema element, a frequency of lengths of values of the particularschema element, a frequency of patterns of values of the particularschema element, output of one or more hash functions applied to valuesof the particular schema element, and a regular expression for thevalues of the particular schema element. 56-59. (canceled)
 60. Themethod of claim 45, wherein the particular schema element is a log fileand wherein the signature of the particular schema element comprises aplurality of the following: tags, most frequent messages, minimum,average and maximum time between messages, and common fields.